Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
main.exe

Overview

General Information

Sample name:main.exe
Analysis ID:1574322
MD5:641d3930a194bf84385372c84605207c
SHA1:90b6790059fc9944a338af1529933d8e2825cc36
SHA256:93db434151816b6772c378f9fee5ac962ddce54458ac5dd1b16622d3a407224a
Tags:exeuser-lontze7
Infos:

Detection

Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Connects to a pastebin service (likely for C&C)
Found pyInstaller with non standard icon
Sigma detected: Cmd.EXE Missing Space Characters Execution Anomaly
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info

Classification

Process Tree

  • System is w10x64
  • main.exe (PID: 7920 cmdline: "C:\Users\user\Desktop\main.exe" MD5: 641D3930A194BF84385372C84605207C)
    • conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • main.exe (PID: 8060 cmdline: "C:\Users\user\Desktop\main.exe" MD5: 641D3930A194BF84385372C84605207C)
      • cmd.exe (PID: 8096 cmdline: C:\Windows\system32\cmd.exe /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 8112 cmdline: C:\Windows\system32\cmd.exe /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 8128 cmdline: C:\Windows\system32\cmd.exe /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • cmd.exe (PID: 8144 cmdline: C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • mode.com (PID: 8160 cmdline: mode con: cols=125 lines=35 MD5: BEA7464830980BF7C0490307DB4FC875)
      • cmd.exe (PID: 8184 cmdline: C:\Windows\system32\cmd.exe /c cls MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Cmd.EXE Missing Space Characters Execution Anomaly
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c, CommandLine: C:\Windows\system32\cmd.exe /c, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\main.exe", ParentImage: C:\Users\user\Desktop\main.exe, ParentProcessId: 8060, ParentProcessName: main.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c, ProcessId: 8096, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: main.exeReversingLabs: Detection: 13%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Source: main.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: main.exe, 00000003.00000002.1580895631.00007FFBAA121000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: main.exe, 00000003.00000002.1580895631.00007FFBAA121000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: main.exe, 00000000.00000003.1432742920.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: main.exe, 00000000.00000003.1432742920.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570377706.0000021529250000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: main.exe, 00000003.00000002.1582260237.00007FFBAAAEB000.00000002.00000001.01000000.00000004.sdmp
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E47800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF784E47800
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E48840 FindFirstFileExW,FindClose,0_2_00007FF784E48840
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E62AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF784E62AE4
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E48840 FindFirstFileExW,FindClose,3_2_00007FF784E48840
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E47800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,3_2_00007FF784E47800
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E62AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF784E62AE4

Networking

barindex
Connects to a pastebin service (likely for C&C)
Source: unknownDNS query: name: pastebin.com
Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficDNS traffic detected: DNS query: pastebin.com
Source: main.exe, 00000003.00000002.1575025508.000002152A130000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.co
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2FD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2FD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: main.exe, 00000003.00000003.1566345903.000002152ABFA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542362536.000002152ABF8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542177597.000002152ABF3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534549689.000002152A929000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1569985402.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541034781.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527439093.000002152A920000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529597432.000002152A928000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558325833.000002152785B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539201928.000002152A92E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560964766.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553008499.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539053396.000002152A929000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577457171.000002152AB09000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1569807743.000002152782B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1538239445.000002152AB09000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527408799.000002152AB05000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1569198260.000002152782B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1562282759.000002152AB09000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlI1
Source: main.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: main.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: main.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: main.exe, 00000003.00000003.1534549689.000002152A929000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541034781.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527439093.000002152A920000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529597432.000002152A928000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539201928.000002152A92E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553008499.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539053396.000002152A929000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: main.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crlp
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2FD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: main.exe, 00000003.00000002.1579296886.000002152B6C0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1566763751.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577706200.000002152ABD5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: main.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: main.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: main.exe, 00000003.00000002.1573029505.00000215299F0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: main.exe, 00000003.00000003.1527236392.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533997526.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541495327.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1563844595.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1576509111.000002152A98A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: main.exe, 00000003.00000003.1541198400.000002152AB3A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577555847.000002152AB3A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525904793.000002152AB3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: main.exe, 00000003.00000003.1540767703.000002152A958000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539417840.000002152A956000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554344678.000002152AA91000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1535938275.000002152A951000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527439093.000002152A920000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530115035.000002152A93A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529142408.000002152A936000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AA98000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: main.exe, 00000003.00000003.1475188657.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533795761.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559050256.0000021529DB3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558295108.0000021529DB2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528601588.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555928578.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1557095306.0000021529DAC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
Source: main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
Source: main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2FD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2FD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
Source: main.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org
Source: main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466001698.0000021529CBF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466717454.0000021529CBF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1568770870.0000021529CCF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1573805398.0000021529CCF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
Source: main.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://python.org:80
Source: main.exe, 00000003.00000002.1576998718.000002152AA96000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: main.exe, 00000003.00000003.1533795761.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543032537.0000021529DC2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528601588.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539898558.0000021529DC0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553748430.0000021529DC3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/5
Source: main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579079178.000002152B64C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1569985402.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558325833.000002152785B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560964766.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: main.exe, 00000003.00000002.1573558406.0000021529C5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: main.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: main.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm)
Source: main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: main.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
Source: main.exe, 00000003.00000003.1537746949.0000021529896000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1537084893.0000021529895000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1544012197.000002152AD0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542206074.000002152AD07000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527027271.000002152985A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531150545.0000021529895000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542154161.000002152ACFC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152AD0A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526725484.0000021529835000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555881245.000002152989D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527371028.0000021529881000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152980B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528131163.0000021529893000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526930497.0000021529836000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: main.exe, 00000003.00000003.1464780495.0000021529D3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1464780495.0000021529CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1442817823.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1438797613.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1437680199.0000012F6D2FF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: main.exe, 00000003.00000002.1578323969.000002152AD3C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554825324.000002152A90C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540448150.000002152A904000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1538715131.000002152A904000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540992683.000002152AD1F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541126911.000002152AD33000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528173004.000002152A8EF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528270893.000002152A8F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531324203.000002152A8F5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540862812.000002152AA1A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532897613.000002152A901000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: main.exe, 00000003.00000003.1467599346.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463978168.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529507589.00000215299C4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541563266.00000215299D5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463824475.00000215299CA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533197461.00000215299D3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1465791234.00000215299C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: main.exe, 00000003.00000003.1464780495.0000021529D3D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: main.exe, 00000003.00000003.1464780495.0000021529D3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1464780495.0000021529CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: main.exe, 00000003.00000003.1569086991.0000021529C30000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1573286625.0000021529C31000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1566614819.0000021529C29000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560102822.000002152AAEE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560416092.000002152AAF6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577424595.000002152AAF9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1566763751.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577706200.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: main.exe, 00000003.00000003.1525710334.000002152992E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526214071.0000021529933000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558157234.000002152994D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.0000021529934000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559251159.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1537803001.000002152993C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530046312.000002152993A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1565960249.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1572686552.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555819664.0000021529943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://127.0.0.1:8443
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.comP
Source: main.exe, 00000003.00000003.1525710334.000002152992E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526214071.0000021529933000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558157234.000002152994D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.0000021529934000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559251159.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1537803001.000002152993C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530046312.000002152993A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1565960249.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1572686552.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555819664.0000021529943000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
Source: main.exe, 00000003.00000002.1578734888.000002152B2A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/guilds/
Source: main.exe, 00000003.00000002.1578734888.000002152B2A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/guilds/Pu4
Source: main.exe, 00000003.00000003.1471531186.000002152A959000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v
Source: main.exe, 00000003.00000003.1471531186.000002152A959000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v10
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/0UB
Source: main.exe, 00000003.00000002.1578734888.000002152B2A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/channels/
Source: main.exe, 00000003.00000002.1575713565.000002152A6A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532248143.0000021529E94000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561909267.000002152A590000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530554006.0000021529E5F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1524721233.0000021529E3D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/developers/applications/
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/events/
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/events/p
Source: main.exe, 00000003.00000003.1561791738.000002152AFA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/oauth2/authorize?client_id=
Source: main.exe, 00000003.00000003.1561791738.000002152AFA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.com/oauth2/authorize?client_id=0
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.gg
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.new/
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://discord.new/PH=
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560102822.000002152AAD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1462739717.0000021529C25000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466717454.0000021529C15000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466001698.0000021529C11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: main.exe, 00000003.00000003.1525710334.000002152992E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1572822058.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463978168.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1465791234.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525788377.000002152996D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527959089.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541686249.000002152996F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: main.exe, 00000003.00000003.1544858524.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559050256.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1544858524.0000021529DE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1557095306.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526295891.0000021529DE6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1574511347.0000021529DD7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556916464.0000021529DF1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559442230.0000021529DCE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542963769.0000021529DE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534904793.0000021529DCA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525876224.0000021529DC6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.7/library/asyncio-eventloop.html
Source: main.exe, 00000003.00000003.1466717454.0000021529CF8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541406402.0000021529CF5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539249856.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1469265143.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543432735.0000021529CFA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: main.exe, 00000003.00000002.1570568591.00000215293E0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.00000215291C8000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.00000215291C8000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: main.exe, 00000003.00000002.1570568591.00000215293E0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: main.exe, 00000003.00000002.1570568591.00000215293E0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: main.exe, 00000003.00000003.1534083100.0000021529642000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526070188.000002152962E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1548346144.0000021529643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: main.exe, 00000003.00000002.1575713565.000002152A6A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: main.exe, 00000003.00000002.1575713565.000002152A6A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION0
Source: main.exe, 00000003.00000003.1531401399.000002152A7B2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1538476252.000002152A7E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534059394.000002152A7E7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528417631.000002152AA3F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529006961.000002152A7B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553686347.000002152A7E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528297806.000002152AA25000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527792935.000002152A7A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.rs/regex/latest/regex/#syntax
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://filepreviews.io/
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: main.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000002.1575313199.000002152A360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com
Source: main.exe, 00000003.00000003.1533795761.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543032537.0000021529DC2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528601588.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539898558.0000021529DC0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/Rapptz/discord.py
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: main.exe, 00000003.00000003.1525468313.000002152AD6F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578495008.000002152AD78000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579626645.000002152B80C000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542085241.000002152AD78000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528958295.000002152AD77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: main.exe, 00000003.00000002.1579626645.000002152B80C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/55pK
Source: main.exe, 00000003.00000003.1540506972.000002152A7A6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531401399.000002152A7A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536015324.0000021529E66000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530554006.0000021529E5F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1524721233.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527792935.000002152A7A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/freyacodes/Lavalink
Source: main.exe, 00000003.00000002.1579296886.000002152B7AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: main.exe, 00000003.00000003.1466717454.0000021529CF8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.00000215298AA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541406402.0000021529CF5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539249856.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1469265143.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543432735.0000021529CFA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: main.exe, 00000003.00000003.1467599346.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559309798.00000215299BC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529734368.00000215299B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: main.exe, 00000003.00000003.1466717454.0000021529CF8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541406402.0000021529CF5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539249856.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1469265143.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543432735.0000021529CFA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: main.exe, 00000003.00000002.1570163488.00000215291C8000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: main.exe, 00000003.00000003.1534609030.000002152961A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1460131078.0000021529955000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1459964515.0000021529955000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527984175.0000021529606000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560543158.0000021529622000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1568047225.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533282186.0000021529611000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561595116.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1571305343.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529209130.0000021529609000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/sponsors/hynek).
Source: main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: main.exe, 00000003.00000003.1554372051.000002152AA8C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: main.exe, 00000003.00000002.1579079178.000002152B64C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: main.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: main.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/32900
Source: main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556118668.000002152963B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560197330.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: main.exe, 00000003.00000003.1539053396.000002152A929000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: main.exe, 00000003.00000003.1555636280.0000021529D68000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1574399501.0000021529D7C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D68000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528047043.0000021529D66000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559754376.0000021529D79000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: main.exe, 00000003.00000003.1556118668.000002152963B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: main.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAAA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532897613.000002152A901000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554010180.000002152A919000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539806778.000002152AAC7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://i.scdn.co/image/
Source: main.exe, 00000003.00000002.1579296886.000002152B6C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: main.exe, 00000003.00000003.1533507030.0000021529D0D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://klaviyo.com/
Source: main.exe, 00000003.00000003.1548788805.0000021529D54000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467533726.0000021529EE1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533254992.0000021529D4F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1468912884.0000021529D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/
Source: main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/stickers/
Source: main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/stickers/0
Source: main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com/track/
Source: main.exe, 00000003.00000003.1524721233.0000021529EBB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554606318.0000021529FFE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1538773448.0000021529FFB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546515974.0000021529FFB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529186356.0000021529FFA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/sp
Source: main.exe, 00000003.00000002.1578958854.000002152B4A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579079178.000002152B678000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554484084.000002152A99D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: main.exe, 00000003.00000002.1579626645.000002152B820000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/s3zW1TU1
Source: main.exe, 00000003.00000003.1458882874.000002152969E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1571852428.00000215296E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
Source: main.exe, 00000003.00000002.1582260237.00007FFBAAAEB000.00000002.00000001.01000000.00000004.sdmpString found in binary or memory: https://peps.python.org/pep-0263/
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0649/)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: main.exe, 00000003.00000003.1557827863.00000215298CB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528826204.00000215298A9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527027271.000002152985A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530554006.0000021529E5F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526725484.0000021529835000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531150545.00000215298AA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1524721233.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527371028.0000021529881000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152980B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528131163.0000021529893000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526930497.0000021529836000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://projectfluent.org
Source: main.exe, 00000003.00000003.1528958295.000002152AD77000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: main.exe, 00000003.00000002.1579296886.000002152B768000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errorp
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/attrs/)
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539806778.000002152AAC7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579296886.000002152B768000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: main.exe, 00000003.00000003.1528173004.000002152A8EF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554825324.000002152A8F5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528270893.000002152A8F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531324203.000002152A8F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: main.exe, 00000003.00000003.1556669621.000002152A9A1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1548457646.0000021529638000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1564905124.000002152A9A1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554484084.000002152A99D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560197330.000002152A9A1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526070188.000002152962E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542533175.000002152962F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556118668.000002152963B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: main.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: main.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/)
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1581515545.00007FFBAA262000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://www.openssl.org/H
Source: main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539806778.000002152AAC7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAC8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: main.exe, 00000003.00000003.1469265143.0000021529D0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1548788805.0000021529D54000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1574298029.0000021529D56000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467533726.0000021529EE1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555175301.0000021529D56000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533254992.0000021529D4F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1468912884.0000021529D47000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
Source: main.exe, 00000003.00000003.1455650468.000002152965A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456127875.0000021529668000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455794575.0000021529668000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455981158.000002152965A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455650468.0000021529648000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455981158.0000021529648000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: main.exe, 00000003.00000002.1582496194.00007FFBAAB88000.00000004.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.python.org/psf/license/
Source: main.exe, 00000003.00000003.1540506972.000002152A7A6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531401399.000002152A7A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527792935.000002152A7A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.variomedia.de/
Source: main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
Source: main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/)
Source: main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560197330.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E66E700_2_00007FF784E66E70
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E480200_2_00007FF784E48020
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E67BD40_2_00007FF784E67BD4
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E61B380_2_00007FF784E61B38
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E48DC00_2_00007FF784E48DC0
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E515380_2_00007FF784E51538
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E50D180_2_00007FF784E50D18
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E596D00_2_00007FF784E596D0
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E676880_2_00007FF784E67688
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E61B380_2_00007FF784E61B38
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E64E800_2_00007FF784E64E80
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5F6380_2_00007FF784E5F638
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5AE200_2_00007FF784E5AE20
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5EFB80_2_00007FF784E5EFB8
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E527B80_2_00007FF784E527B8
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E53F8C0_2_00007FF784E53F8C
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E537500_2_00007FF784E53750
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5173C0_2_00007FF784E5173C
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E50F1C0_2_00007FF784E50F1C
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E670EC0_2_00007FF784E670EC
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4989B0_2_00007FF784E4989B
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E590200_2_00007FF784E59020
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E6A9980_2_00007FF784E6A998
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E511280_2_00007FF784E51128
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E62AE40_2_00007FF784E62AE4
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4A26D0_2_00007FF784E4A26D
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E49A340_2_00007FF784E49A34
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E53B880_2_00007FF784E53B88
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5132C0_2_00007FF784E5132C
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E6531C0_2_00007FF784E6531C
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5EB240_2_00007FF784E5EB24
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E56CF00_2_00007FF784E56CF0
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E544500_2_00007FF784E54450
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E524200_2_00007FF784E52420
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E53F8C3_2_00007FF784E53F8C
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E67BD43_2_00007FF784E67BD4
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E48DC03_2_00007FF784E48DC0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E515383_2_00007FF784E51538
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E50D183_2_00007FF784E50D18
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E596D03_2_00007FF784E596D0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E676883_2_00007FF784E67688
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E61B383_2_00007FF784E61B38
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E64E803_2_00007FF784E64E80
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E66E703_2_00007FF784E66E70
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5F6383_2_00007FF784E5F638
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5AE203_2_00007FF784E5AE20
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5EFB83_2_00007FF784E5EFB8
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E527B83_2_00007FF784E527B8
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E537503_2_00007FF784E53750
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5173C3_2_00007FF784E5173C
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E50F1C3_2_00007FF784E50F1C
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E670EC3_2_00007FF784E670EC
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E4989B3_2_00007FF784E4989B
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E480203_2_00007FF784E48020
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E590203_2_00007FF784E59020
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E6A9983_2_00007FF784E6A998
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E511283_2_00007FF784E51128
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E62AE43_2_00007FF784E62AE4
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E4A26D3_2_00007FF784E4A26D
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E49A343_2_00007FF784E49A34
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E53B883_2_00007FF784E53B88
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E61B383_2_00007FF784E61B38
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5132C3_2_00007FF784E5132C
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E6531C3_2_00007FF784E6531C
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5EB243_2_00007FF784E5EB24
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E56CF03_2_00007FF784E56CF0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E544503_2_00007FF784E54450
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E524203_2_00007FF784E52420
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAA6518A03_2_00007FFBAA6518A0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAB7C03A03_2_00007FFBAB7C03A0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAB7BBFE03_2_00007FFBAB7BBFE0
Source: C:\Users\user\Desktop\main.exeCode function: String function: 00007FF784E42020 appears 34 times
Source: C:\Users\user\Desktop\main.exeCode function: String function: 00007FFBAB7B37C0 appears 34 times
Source: C:\Users\user\Desktop\main.exeCode function: String function: 00007FF784E41E50 appears 106 times
Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: python3.dll.0.drStatic PE information: No import functions for PE file found
Source: main.exe, 00000000.00000003.1433769162.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1433564075.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs main.exe
Source: main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1440126843.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1438998368.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs main.exe
Source: main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1435004502.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1432742920.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs main.exe
Source: main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs main.exe
Source: main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs main.exe
Source: main.exeBinary or memory string: OriginalFilename vs main.exe
Source: main.exe, 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs main.exe
Source: main.exe, 00000003.00000002.1581515545.00007FFBAA262000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs main.exe
Source: main.exe, 00000003.00000002.1570377706.0000021529250000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs main.exe
Source: main.exe, 00000003.00000002.1584392886.00007FFBAAD27000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs main.exe
Source: classification engineClassification label: mal64.troj.winEXE@16/38@1/2
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\Desktop\bot_log.txtJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202Jump to behavior
Source: main.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\main.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: main.exeReversingLabs: Detection: 13%
Source: C:\Users\user\Desktop\main.exeFile read: C:\Users\user\Desktop\main.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mode.com mode con: cols=125 lines=35
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"Jump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35Jump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c clsJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mode.com mode con: cols=125 lines=35Jump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: libffi-8.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: libssl-3.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: libcrypto-3.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\mode.comSection loaded: ulib.dllJump to behavior
Source: C:\Windows\System32\mode.comSection loaded: ureg.dllJump to behavior
Source: C:\Windows\System32\mode.comSection loaded: fsutilext.dllJump to behavior
Source: C:\Users\user\Desktop\main.exeFile written: C:\Users\user\Desktop\config.iniJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: main.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: main.exeStatic file information: File size 12170881 > 1048576
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: main.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: main.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: main.exe, 00000000.00000003.1449230247.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: main.exe, 00000000.00000003.1449423460.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: main.exe, 00000000.00000003.1433957264.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.9 30 May 20233.0.9built on: Tue Jul 11 19:52:20 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL || WITHIN_ARENA(temp->next)assertion failed: (char **)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) || WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/*0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: main.exe, 00000003.00000002.1580895631.00007FFBAA121000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: main.exe, 00000000.00000003.1433269083.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: main.exe, 00000000.00000003.1435736579.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: main.exe, 00000003.00000002.1580895631.00007FFBAA121000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: main.exe, 00000000.00000003.1434686247.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: main.exe, 00000000.00000003.1434197011.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: main.exe, 00000000.00000003.1434528679.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: main.exe, 00000000.00000003.1433406256.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: main.exe, 00000000.00000003.1432742920.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: main.exe, 00000000.00000003.1432742920.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: main.exe, 00000000.00000003.1434831148.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python3.pdb source: main.exe, 00000000.00000003.1440395031.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570377706.0000021529250000.00000002.00000001.01000000.00000006.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: main.exe, 00000000.00000003.1434335445.0000012F6D2F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a\1\b\bin\amd64\python311.pdb source: main.exe, 00000003.00000002.1582260237.00007FFBAAAEB000.00000002.00000001.01000000.00000004.sdmp
Source: main.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: main.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: main.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: main.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: main.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: VCRUNTIME140.dll.0.drStatic PE information: 0xC94BF788 [Wed Jan 6 22:49:44 2077 UTC]
Source: libcrypto-3.dll.0.drStatic PE information: section name: .00cfg
Source: libssl-3.dll.0.drStatic PE information: section name: .00cfg
Source: python311.dll.0.drStatic PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\main.exeProcess created: "C:\Users\user\Desktop\main.exe"
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\select.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\libffi-8.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\backend_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\libssl-3.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\libcrypto-3.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\_cffi.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI79202\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E46B00 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,0_2_00007FF784E46B00
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\select.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_uuid.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache\_helpers_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\backend_c.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\python311.dllJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_decimal.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\_cffi.cp311-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_asyncio.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79202\_overlapped.pydJump to dropped file
Source: C:\Users\user\Desktop\main.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-18590
Source: C:\Users\user\Desktop\main.exeAPI coverage: 5.4 %
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E47800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,0_2_00007FF784E47800
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E48840 FindFirstFileExW,FindClose,0_2_00007FF784E48840
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E62AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF784E62AE4
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E48840 FindFirstFileExW,FindClose,3_2_00007FF784E48840
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E47800 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,3_2_00007FF784E47800
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E62AE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF784E62AE4
Source: main.exe, 00000000.00000003.1436875688.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: main.exe, 00000003.00000003.1554993090.0000021529913000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463087711.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463978168.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1462416275.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553159011.0000021529913000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1461298795.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1465791234.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526024249.0000021529912000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF784E5B558
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E646F0 GetProcessHeap,0_2_00007FF784E646F0
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E5B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF784E5B558
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF784E4C6FC
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF784E4BE60
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4C8A0 SetUnhandledExceptionFilter,0_2_00007FF784E4C8A0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E5B558 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF784E5B558
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E4C6FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF784E4C6FC
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E4BE60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF784E4BE60
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FF784E4C8A0 SetUnhandledExceptionFilter,3_2_00007FF784E4C8A0
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAA652A90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FFBAA652A90
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAA653058 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFBAA653058
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAB7C3A38 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFBAB7C3A38
Source: C:\Users\user\Desktop\main.exeCode function: 3_2_00007FFBAB7C3480 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FFBAB7C3480
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Users\user\Desktop\main.exe "C:\Users\user\Desktop\main.exe"Jump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /cJump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35Jump to behavior
Source: C:\Users\user\Desktop\main.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c clsJump to behavior
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mode.com mode con: cols=125 lines=35Jump to behavior
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E6A7E0 cpuid 0_2_00007FF784E6A7E0
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\libcrypto-3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\libffi-8.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\libssl-3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\pyexpat.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\python3.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_asyncio.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_decimal.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_multiprocessing.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict\_multidict.cp311-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\multidict VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\yarl VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\propcache\_helpers_c.cp311-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202\_uuid.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI79202 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeQueries volume information: C:\Users\user\Desktop\main.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E4C5E0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF784E4C5E0
Source: C:\Users\user\Desktop\main.exeCode function: 0_2_00007FF784E66E70 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF784E66E70

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Native API		1
DLL Side-Loading		11
Process Injection		1
Masquerading		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Web Service		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		11
Process Injection		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media12
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared Drive1
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Obfuscated Files or Information		NTDS22
System Information Discovery		Distributed Component Object ModelInput Capture2
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Timestomp		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1574322 Sample: main.exe Startdate: 13/12/2024 Architecture: WINDOWS Score: 64 36 pastebin.com 2->36 42 Multi AV Scanner detection for submitted file 2->42 44 Sigma detected: Cmd.EXE Missing Space Characters Execution Anomaly 2->44 46 AI detected suspicious sample 2->46 9 main.exe 46 2->9         started        signatures3 48 Connects to a pastebin service (likely for C&C) 36->48 process4 file5 28 C:\Users\...\backend_c.cp311-win_amd64.pyd, PE32+ 9->28 dropped 30 C:\Users\user\...\_cffi.cp311-win_amd64.pyd, PE32+ 9->30 dropped 32 C:\Users\...\_quoting_c.cp311-win_amd64.pyd, PE32+ 9->32 dropped 34 25 other files (none is malicious) 9->34 dropped 50 Found pyInstaller with non standard icon 9->50 13 main.exe 3 9->13         started        16 conhost.exe 9->16         started        signatures6 process7 dnsIp8 38 pastebin.com 104.20.4.235, 443, 49709 CLOUDFLARENETUS United States 13->38 40 127.0.0.1 unknown unknown 13->40 18 cmd.exe 1 13->18         started        20 cmd.exe 1 13->20         started        22 cmd.exe 1 13->22         started        24 2 other processes 13->24 process9 process10 26 mode.com 1 18->26         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
main.exe13%ReversingLabsWin64.Malware.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI79202\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_asyncio.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_multiprocessing.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_overlapped.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\_uuid.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md__mypyc.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\libcrypto-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\libffi-8.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\libssl-3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\multidict\_multidict.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\propcache\_helpers_c.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\pyexpat.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\python3.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\python311.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\select.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\unicodedata.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\yarl\_quoting_c.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\_cffi.cp311-win_amd64.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\backend_c.cp311-win_amd64.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).0%Avira URL Cloudsafe
https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)0%Avira URL Cloudsafe
http://repository.swisssign.com/50%Avira URL Cloudsafe
https://www.attrs.org/)0%Avira URL Cloudsafe
https://www.attrs.org/en/stable/why.html#data-classes)0%Avira URL Cloudsafe
https://www.attrs.org/en/24.2.0/_static/sponsors/0%Avira URL Cloudsafe
https://filepreviews.io/0%Avira URL Cloudsafe
https://wwww.certigna.fr/autorites/)0%Avira URL Cloudsafe
https://www.attrs.org/en/latest/names.html)0%Avira URL Cloudsafe
https://www.attrs.org/en/stable/changelog.html0%Avira URL Cloudsafe
https://www.attrs.org/0%Avira URL Cloudsafe
https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracing0%Avira URL Cloudsafe
https://peps.python.org/pep-0749/)-implementing0%Avira URL Cloudsafe
https://www.variomedia.de/0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
pastebin.com
104.20.4.235
truefalse
    		high

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    https://discord.com/channels/main.exe, 00000003.00000002.1578734888.000002152B2A0000.00000004.00001000.00020000.00000000.sdmpfalse
      		high
      https://github.com/asweigart/pyperclip/issues/55main.exe, 00000003.00000003.1525468313.000002152AD6F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578495008.000002152AD78000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579626645.000002152B80C000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542085241.000002152AD78000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528958295.000002152AD77000.00000004.00000020.00020000.00000000.sdmpfalse
        		high
        https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONmain.exe, 00000003.00000002.1575713565.000002152A6A0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://github.com/python-attrs/attrs/issues/251main.exe, 00000003.00000003.1467599346.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559309798.00000215299BC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.00000215299B1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529734368.00000215299B1000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://klaviyo.com/main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://i.scdn.co/image/main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://discord.com/developers/applications/main.exe, 00000003.00000002.1575713565.000002152A6A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532248143.0000021529E94000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561909267.000002152A590000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530554006.0000021529E5F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1524721233.0000021529E3D000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://docs.python.org/3.7/library/asyncio-eventloop.htmlmain.exe, 00000003.00000003.1544858524.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559050256.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1544858524.0000021529DE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1557095306.0000021529DCB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526295891.0000021529DE6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1574511347.0000021529DD7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556916464.0000021529DF1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559442230.0000021529DCE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542963769.0000021529DE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534904793.0000021529DCA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525876224.0000021529DC6000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://python.orgmain.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://www.attrs.org/en/24.2.0/_static/sponsors/main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://python.org:80main.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        https://discord.com/events/pmain.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/sponsors/hynekmain.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              http://repository.swisssign.com/5main.exe, 00000003.00000003.1533795761.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543032537.0000021529DC2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528601588.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529DAC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539898558.0000021529DC0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553748430.0000021529DC3000.00000004.00000020.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://github.com/python-attrs/attrs/issues/1328)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                https://discord.com/api/vmain.exe, 00000003.00000003.1471531186.000002152A959000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://discord.com/api/webhooks/0UBmain.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		high
                                    https://tools.ietf.org/html/rfc2388#section-4.4main.exe, 00000003.00000003.1528173004.000002152A8EF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554825324.000002152A8F5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528270893.000002152A8F4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531324203.000002152A8F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64main.exe, 00000003.00000003.1525710334.000002152992E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1572822058.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1463978168.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1465791234.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525788377.000002152996D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527959089.000002152996F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529968000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541686249.000002152996F000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://github.com/asweigart/pyperclip/issues/55pKmain.exe, 00000003.00000002.1579626645.000002152B80C000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svgmain.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://wwww.certigna.fr/autorites/)main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://github.com/python-attrs/attrs)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.attrs.org/)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://crl.xrampsecurity.com/XGCA.crlpmain.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://docs.python.org/3/library/subprocess#subprocess.Popen.killmain.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/python-attrs/attrs/issues/136main.exe, 00000003.00000003.1466717454.0000021529CF8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.00000215298AA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541406402.0000021529CF5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539249856.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1469265143.0000021529CF2000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543432735.0000021529CFA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://peps.python.org/pep-0205/main.exe, 00000003.00000003.1458882874.000002152969E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1571852428.00000215296E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://crl.dhimyotis.com/certignarootca.crlmain.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://curl.haxx.se/rfc/cookie_spec.htmlmain.exe, 00000003.00000002.1579296886.000002152B6C0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1566763751.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577706200.000002152ABD5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://ocsp.accv.esmain.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodemain.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://github.com/python-attrs/attrs/issues/1329)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://pastebin.com/s3zW1TU1main.exe, 00000003.00000002.1579626645.000002152B820000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000002.1573118595.0000021529AF0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://discord.com/oauth2/authorize?client_id=main.exe, 00000003.00000003.1561791738.000002152AFA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamemain.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxymain.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688main.exe, 00000003.00000002.1570163488.00000215291C8000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://httpbin.org/getmain.exe, 00000003.00000002.1579079178.000002152B5A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAAA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532897613.000002152A901000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554010180.000002152A919000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/python-attrs/attrs/issues/1330)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.accv.es/legislacion_c.htm)main.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://discord.new/PH=main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://discord.com/api/guilds/main.exe, 00000003.00000002.1578734888.000002152B2A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_codemain.exe, 00000003.00000002.1570568591.00000215293E0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2main.exe, 00000003.00000003.1525710334.000002152992E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467599346.0000021529911000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526214071.0000021529933000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558157234.000002152994D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527126799.0000021529934000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1559251159.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1537803001.000002152993C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152990F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530046312.000002152993A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1565960249.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1572686552.0000021529950000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555819664.0000021529943000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://wwww.certigna.fr/autorites/0mmain.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readermain.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://media.discordapp.net/stickers/0main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://github.com/python/cpython/issues/86361.main.exe, 00000003.00000003.1534609030.000002152961A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1460131078.0000021529955000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1459964515.0000021529955000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527984175.0000021529606000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560543158.0000021529622000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1568047225.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533282186.0000021529611000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561595116.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1571305343.0000021529624000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529209130.0000021529609000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://httpbin.org/main.exe, 00000003.00000003.1556118668.000002152963B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://www.attrs.org/en/latest/names.html)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://discord.com/api/v10main.exe, 00000003.00000003.1471531186.000002152A959000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1578534205.000002152B0A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://wwww.certigna.fr/autorites/main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1540953603.000002152AD0F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlmain.exe, 00000003.00000003.1464780495.0000021529D3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1464780495.0000021529CEE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_modulemain.exe, 00000003.00000002.1570568591.00000215293E0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_cachesmain.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://filepreviews.io/main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: safe
                                                                                                              		unknown
                                                                                                              https://github.com/freyacodes/Lavalinkmain.exe, 00000003.00000003.1540506972.000002152A7A6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531401399.000002152A7A4000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536015324.0000021529E66000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530554006.0000021529E5F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1475188657.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1524721233.0000021529E3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527792935.000002152A7A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.attrs.org/en/stable/why.html#data-classes)main.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://discord.com/api/webhooks/main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535main.exe, 00000003.00000003.1540767703.000002152A958000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539417840.000002152A956000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554344678.000002152AA91000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1535938275.000002152A951000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527439093.000002152A920000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530115035.000002152A93A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529142408.000002152A936000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AA98000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_symain.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457449808.0000021527867000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1561235398.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1556191469.0000021527875000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570686474.00000215295E0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1457017113.0000021527851000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1567072966.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527768189.0000021527863000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456641330.0000021527869000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570072632.0000021527877000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.python.org/psf/license/main.exe, 00000003.00000002.1582496194.00007FFBAAB88000.00000004.00000001.01000000.00000004.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://discord.com/oauth2/authorize?client_id=0main.exe, 00000003.00000003.1561791738.000002152AFA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://docs.python.org/3/library/multiprocessing.htmlmain.exe, 00000003.00000003.1534083100.0000021529642000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526070188.000002152962E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1548346144.0000021529643000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://crl.securetrust.com/STCA.crlmain.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://wwwsearch.sf.net/):main.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560102822.000002152AAEE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560416092.000002152AAF6000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577424595.000002152AAF9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1566763751.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1577706200.000002152ABD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0main.exe, 00000003.00000003.1525351895.0000021527816000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1569985402.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526317641.000002152782A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1558325833.000002152785B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560964766.000002152785C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526782941.000002152785A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.accv.es/legislacion_c.htmmain.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://tools.ietf.org/html/rfc6125#section-6.4.3main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546092870.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542320473.000002152AA9E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539532175.000002152AA9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579079178.000002152B64C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.attrs.org/en/stable/changelog.htmlmain.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      http://crl.xrampsecurity.com/XGCA.crl0main.exe, 00000003.00000003.1534549689.000002152A929000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541034781.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527439093.000002152A920000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529597432.000002152A928000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539201928.000002152A92E000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1553008499.000002152A931000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539053396.000002152A929000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://docs.aiohttp.org/en/stable/client_advanced.html#client-tracingmain.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560102822.000002152AAD5000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1462739717.0000021529C25000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466717454.0000021529C15000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555468523.000002152AAD0000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539127977.000002152AACD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466001698.0000021529C11000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        https://www.variomedia.de/main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        http://www.cert.fnmt.es/dpcs/main.exe, 00000003.00000003.1537746949.0000021529896000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1537084893.0000021529895000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1544012197.000002152AD0D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542206074.000002152AD07000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527027271.000002152985A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1531150545.0000021529895000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1542154161.000002152ACFC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152AD0A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526725484.0000021529835000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1555881245.000002152989D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527371028.0000021529881000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525008919.000002152980B000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528131163.0000021529893000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526930497.0000021529836000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://google.com/mailmain.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1560197330.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://packaging.python.org/specifications/entry-points/main.exe, 00000003.00000002.1578958854.000002152B4A0000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527080216.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1579079178.000002152B678000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554484084.000002152A99D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541276449.000002152A998000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525537140.000002152A998000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://www.accv.es00main.exe, 00000003.00000003.1541160530.0000021529C7F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1543063180.000002152ACE8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541085478.0000021529C5C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539970871.000002152ACE7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1534747551.000002152ACE7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pymain.exe, 00000003.00000003.1529533463.0000021527874000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmmain.exe, 00000003.00000003.1464780495.0000021529D3D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1464780495.0000021529CEE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://packaging.python.org/spmain.exe, 00000003.00000003.1524721233.0000021529EBB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554606318.0000021529FFE000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1538773448.0000021529FFB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1546515974.0000021529FFB000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1529186356.0000021529FFA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://media.discordapp.net/stickers/main.exe, 00000003.00000002.1578630202.000002152B1A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://foss.heptapod.net/pypy/pypy/-/issues/3539main.exe, 00000003.00000002.1578839646.000002152B3A0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.main.exe, 00000003.00000003.1554372051.000002152AA8C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1528297806.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1536484276.000002152AA83000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1532568933.000002152AA83000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://www.attrs.org/main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                            		unknown
                                                                                                                                                            http://google.com/main.exe, 00000003.00000003.1527236392.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533997526.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1541495327.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1563844595.000002152A98A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1576509111.000002152A98A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://mahler:8092/site-updates.pymain.exe, 00000003.00000003.1548788805.0000021529D54000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1526105645.0000021529D47000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1467533726.0000021529EE1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1525952573.0000021529D2C000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530251457.0000021529D49000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527286601.0000021529D48000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1533254992.0000021529D4F000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1468912884.0000021529D47000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://crl.securetrust.com/SGCA.crlmain.exe, 00000003.00000003.1541359471.0000021529C41000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527582803.0000021529C27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://.../back.jpegmain.exe, 00000003.00000002.1575025508.000002152A130000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.python.org/download/releases/2.3/mro/.main.exe, 00000003.00000003.1455650468.000002152965A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1456127875.0000021529668000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455794575.0000021529668000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455981158.000002152965A000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455650468.0000021529648000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1455981158.0000021529648000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://github.commain.exe, 00000003.00000002.1575143973.000002152A240000.00000004.00001000.00020000.00000000.sdmp, main.exe, 00000003.00000002.1575313199.000002152A360000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://httpbin.org/postmain.exe, 00000003.00000003.1526167728.000002152AAB8000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1539806778.000002152AAC7000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1554039816.000002152AAC8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errormain.exe, 00000003.00000003.1528958295.000002152AD77000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://python.org/main.exe, 00000003.00000003.1533619919.0000021529CCC000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466001698.0000021529CBF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1466717454.0000021529CBF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1568770870.0000021529CCF000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1527479541.0000021529CBA000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1530932276.0000021529CBD000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1573805398.0000021529CCF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_sourcemain.exe, 00000003.00000003.1454613076.00000215295E1000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000003.1454593775.00000215295E9000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000003.00000002.1570163488.0000021529140000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://peps.python.org/pep-0749/)-implementingmain.exe, 00000000.00000003.1435959438.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D300000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000000.00000003.1435891210.0000012F6D2F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                		unknown

                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                Public IPs

                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                104.20.4.235
                                                                                                                                                                                		pastebin.comUnited States
                                                                                                                                                                                		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                Private

                                                                                                                                                                                IP
                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                General Information

                                                                                                                                                                                Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                Analysis ID:1574322
                                                                                                                                                                                Start date and time:2024-12-13 08:35:52 +01:00
                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                Overall analysis duration:0h 6m 52s
                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                Report type:full
                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                Number of analysed new started processes analysed:14
                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                Technologies:
                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                Sample name:main.exe
                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                Classification:mal64.troj.winEXE@16/38@1/2
                                                                                                                                                                                EGA Information:
                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                HCA Information:Failed
                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                • Stop behavior analysis, all processes terminated

                                                                                                                                                                                Warnings

                                                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 20.12.23.50
                                                                                                                                                                                • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                • VT rate limit hit for: main.exe

                                                                                                                                                                                Simulations

                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                ⊘No simulations

                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                IPs

                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                104.20.4.235gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                gaber.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                sostener.vbsGet hashmaliciousNjratBrowse
                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                sostener.vbsGet hashmaliciousXWormBrowse
                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                envifa.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                • pastebin.com/raw/NsQ5qTHr

                                                                                                                                                                                Domains

                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                pastebin.comCVmkXJ7e0a.exeGet hashmaliciousSheetRatBrowse
                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                http://annavirgili.comGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                http://annavirgili.comGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                KrnlSetup.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                Revo.Uninstaller.Pro.v5.3.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                Revo.Uninstaller.Pro.v5.3.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                rrats.exeGet hashmaliciousAsyncRATBrowse
                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                Q8o0Mx52Fd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                Q8o0Mx52Fd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                • 104.20.4.235

                                                                                                                                                                                ASNs

                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                CLOUDFLARENETUSin.exeGet hashmaliciousBabadeda, HTMLPhisherBrowse
                                                                                                                                                                                • 104.17.25.14
                                                                                                                                                                                CVmkXJ7e0a.exeGet hashmaliciousSheetRatBrowse
                                                                                                                                                                                • 104.16.185.241
                                                                                                                                                                                naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 172.64.41.3
                                                                                                                                                                                WE8zqotCFj.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                • 162.159.137.232
                                                                                                                                                                                ozAxx9uGHu.exeGet hashmaliciousBlank Grabber, Umbral StealerBrowse
                                                                                                                                                                                • 162.159.136.232
                                                                                                                                                                                naukri-launcher 10.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                • 162.159.61.3
                                                                                                                                                                                eCXXUk54sx.exeGet hashmaliciousDivulge StealerBrowse
                                                                                                                                                                                • 162.159.128.233
                                                                                                                                                                                ZS8xEqirxa.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                • 104.21.27.188
                                                                                                                                                                                wV1Mk5PUmi.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                • 104.21.48.1
                                                                                                                                                                                Rbeu9JMfnq.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                • 104.21.50.161

                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                ⊘No context

                                                                                                                                                                                Dropped Files

                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI79202\VCRUNTIME140.dllUtils.dll.dllGet hashmaliciousCodoso Ghost, HancitorBrowse
                                                                                                                                                                                  Utils.dll.dllGet hashmaliciousHancitorBrowse
                                                                                                                                                                                    ZK2VPbHWN2.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                      SGOEQ4X8yC.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                        a7lPTcLN1m.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                          341J08p1Nk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            341J08p1Nk.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              vUlh7stUHJ.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                vUlh7stUHJ.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                  qe4efGS22G.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\VCRUNTIME140.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):109440
                                                                                                                                                                                                    Entropy (8bit):6.642252418996898
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:BcghDMWyjXZZIzpdbJhKm6Kuzu8fsecbq8uOFQr+zMtY+zA:BVHyQNdbJAKuzRsecbq8uOFvyU
                                                                                                                                                                                                    MD5:49C96CECDA5C6C660A107D378FDFC3D4
                                                                                                                                                                                                    SHA1:00149B7A66723E3F0310F139489FE172F818CA8E
                                                                                                                                                                                                    SHA-256:69320F278D90EFAAEB67E2A1B55E5B0543883125834C812C8D9C39676E0494FC
                                                                                                                                                                                                    SHA-512:E09E072F3095379B0C921D41D6E64F4F1CD78400594A2317CFB5E5DCA03DEDB5A8239ED89905C9E967D1ACB376B0585A35ADDF6648422C7DDB472CE38B1BA60D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                                    • Filename: Utils.dll.dll, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: Utils.dll.dll, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: ZK2VPbHWN2.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: SGOEQ4X8yC.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: a7lPTcLN1m.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: 341J08p1Nk.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: 341J08p1Nk.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: vUlh7stUHJ.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: vUlh7stUHJ.exe, Detection: malicious, Browse
                                                                                                                                                                                                    • Filename: qe4efGS22G.exe, Detection: malicious, Browse
                                                                                                                                                                                                    Reputation:moderate, very likely benign file
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{n...=...=...=l..<...=...=...=...=...=...<...=...<...=...<...=...<...=...=...=...<...=Rich...=........PE..d.....K..........." ...$.....`............................................................`A........................................`C..4....K...............p..|....\...O...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata..|....p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_asyncio.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65304
                                                                                                                                                                                                    Entropy (8bit):6.187244032149753
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:92icaMc9076gzE6+gTKnEzRIsOnev7SyP4xw:92icrclGE6+gTOEzRIsOn2V
                                                                                                                                                                                                    MD5:511A52BCB0BD19EDA7AA980F96723C93
                                                                                                                                                                                                    SHA1:B11AB01053B76EBB60AB31049F551E5229E68DDD
                                                                                                                                                                                                    SHA-256:D1FB700F280E7793E9B0DCA33310EF9CD08E9E0EC4F7416854DFFAF6F658A394
                                                                                                                                                                                                    SHA-512:D29750950DB2ECBD941012D7FBDD74A2BBD619F1A92616A212ACB144DA75880CE8A29EC3313ACBC419194219B17612B27A1833074BBBAA291CDB95B05F8486FF
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T.i..i..i......i.v.h..i.v.l..i.v.m..i.v.j..i...h..i...h..i..h.V.i...d..i...i..i.....i...k..i.Rich.i.........................PE..d....k.d.........." ...$.R..........`...............................................'.....`.............................................P...`...d......................../..........`w..T........................... v..@............p...............................text....P.......R.................. ..`.rdata..~J...p...L...V..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_bz2.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):84760
                                                                                                                                                                                                    Entropy (8bit):6.571366239395909
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:+O1z7poK78xa5yp6aclDqGihM8Vh948L5IsCVQ7SyhxG:31z9h9plDshvVhH5IsCVQk
                                                                                                                                                                                                    MD5:4438AFFAAA0CA1DF5B9B1CDAA0115EC1
                                                                                                                                                                                                    SHA1:4EDA79EAF3DE614D5F744AA9EEA5BFCF66E2D386
                                                                                                                                                                                                    SHA-256:EC91E2B4BACA31B992D016B84B70F110CE2B1B2DFD54F5E5BEF6270ED7D13B85
                                                                                                                                                                                                    SHA-512:6992107AC4D2108E477BC81AF667B8B8E5439231E7E9F4B15CE4BCE1AEEA811BC0F1AAA438BE3B0E38597760CB504367512809EE1937C4B538A86724AE543BA6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,...B...B...B......B.i.C...B.i.....B.i.G...B.i.F...B.i.A...B..C...B..C...B...C..B..O...B..B...B......B..@...B.Rich..B.........................PE..d....k.d.........." ...$.....^...............................................P......2.....`.........................................p...H............0....... .. ......../...@..........T...........................p...@............................................text............................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_ctypes.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):123672
                                                                                                                                                                                                    Entropy (8bit):6.0603476725812415
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:T7u5LnIxdP3fPHW+gfLIhAxKpemWtIsLPKlY:Tw+3FgfLIhFemWeY
                                                                                                                                                                                                    MD5:6114277C6FC040F68D25CA90E25924CD
                                                                                                                                                                                                    SHA1:028179C77CB3BA29CD8494049421EAA4900CCD0E
                                                                                                                                                                                                    SHA-256:F07FE92CE85F7786F96A4D59C6EE5C05FE1DB63A1889BA40A67E37069639B656
                                                                                                                                                                                                    SHA-512:76E8EBEFB9BA4EA8DCAB8FCE50629946AF4F2B3F2F43163F75483CFB0A97968478C8AAEF1D6A37BE85BFC4C91A859DEDA6DA21D3E753DAEFE084A203D839353D
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........D...D...D...M.".B......F......H......L......@...^..F......E......B......G...D.......^..B...^..E...^.N.E...^..E...RichD...........PE..d....k.d.........." ...$............p\..............................................[.....`.........................................pP.......P.........................../..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_decimal.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):253720
                                                                                                                                                                                                    Entropy (8bit):6.554150968006557
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:3V9E1CyOa72oP+pG1/dgD09qWM53pLW1ADDtLRO75e:jEgyOa72jw1/d4VVhLE5e
                                                                                                                                                                                                    MD5:BE315973AFF9BDEB06629CD90E1A901F
                                                                                                                                                                                                    SHA1:151F98D278E1F1308F2BE1788C9F3B950AB88242
                                                                                                                                                                                                    SHA-256:0F9C6CC463611A9B2C692382FE1CDD7A52FEA4733FFAF645D433F716F8BBD725
                                                                                                                                                                                                    SHA-512:8EA715438472E9C174DEE5ECE3C7D9752C31159E2D5796E5229B1DF19F87316579352FC3649373DB066DC537ADF4869198B70B7D4D1D39AC647DA2DD7CFC21E8
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.`...`...`.......`..,....`..,....`..,....`..,....`.......`.......`...`...`.......`.......`.......`....r..`.......`..Rich.`..........................PE..d....k.d.........." ...$.x...<......|...............................................>.....`.........................................0T..P....T...................'......./......P.......T...........................p...@............................................text...-w.......x.................. ..`.rdata..|............|..............@..@.data....*...p...$...T..............@....pdata...'.......(...x..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_hashlib.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):65304
                                                                                                                                                                                                    Entropy (8bit):6.256836184121913
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:nfKlLLgy209/MkZy6nR3JZlivy7OjZopRIsOI/7SyAxn4:fKBgy+IZlh7OjSpRIsOI/M4
                                                                                                                                                                                                    MD5:1524882AF71247ADECF5815A4E55366A
                                                                                                                                                                                                    SHA1:E25014C793C53503BDFF9AF046140EDDA329D01B
                                                                                                                                                                                                    SHA-256:6F7742DFDD371C39048D775F37DF3BC2D8D4316C9008E62347B337D64EBED327
                                                                                                                                                                                                    SHA-512:5B954BB7953F19AA6F7C65AD3F105B77D37077950FB1B50D9D8D337BDD4B95343BAC2F4C9FE17A02D1738D1F87EEEF73DBBF5CDDDCB470588CBC5A63845B188A
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,'@.MI..MI..MI..5...MI.:3H..MI.:3L..MI.:3M..MI.:3J..MI..2H..MI..5H..MI.G0H..MI..MH..MI..2D..MI..2I..MI..2...MI..2K..MI.Rich.MI.........PE..d....l.d.........." ...$.T...~......@@...............................................7....`............................................P... ............................/......X...P}..T............................|..@............p..0............................text....S.......T.................. ..`.rdata...O...p...P...X..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_lzma.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):159000
                                                                                                                                                                                                    Entropy (8bit):6.8491410545695715
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:2tZVL5rdV/REWWjAYyznf49mNo+RRApqc5IsZ1v8N:2tZV3pREMAYO+ElG
                                                                                                                                                                                                    MD5:737119A80303EF4ECCAA998D500E7640
                                                                                                                                                                                                    SHA1:328C67C6C4D297AC13DA725BF24467D8B5E982E3
                                                                                                                                                                                                    SHA-256:7158C1290AC29169160B3EC94D9C8BCDE4012D67A555F325D44B418C54E2CC28
                                                                                                                                                                                                    SHA-512:1C9920E0841A65B01A0B339C5F5254D1039EF9A16FE0C2484A7E2A9048727F2CC081817AA771B0C574FB8D1A5A49DC39798A3C5E5B5E64392E9C168E1827BE7C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..'..lt..lt..lt...t..lt..mu..lt..iu..lt..hu..lt..ou..lt..mu..ltM.mu..lt..mt`.lt..au<.lt..lu..lt..t..lt..nu..ltRich..lt................PE..d....l.d.........." ...$.b...........5....................................................`..........................................%..L...\%..x....p.......P.......>.../......8.......T...........................p...@............................................text...za.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_multiprocessing.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):34584
                                                                                                                                                                                                    Entropy (8bit):6.410940768849398
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:hXI6RwgJ5xeDTdywGnJ8BIsWt6F5YiSyvWKAMxkE9:pIoJ5UDTdywGJ8BIsWt6L7SyuoxB
                                                                                                                                                                                                    MD5:2CA9FE51BF2EE9F56F633110A08B45CD
                                                                                                                                                                                                    SHA1:88BA6525C71890A50F07547A5E9EAD0754DD85B9
                                                                                                                                                                                                    SHA-256:1D6F1E7E9F55918967A37CBD744886C2B7EE193C5FB8F948132BA40B17119A81
                                                                                                                                                                                                    SHA-512:821551FA1A5AA21F76C4AE05F44DDD4C2DAA00329439C6DADC861931FA7BD8E464B4441DFE14383F2BB30C2FC2DFB94578927615B089A303AA39240E15E89DE5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........G.*.&.y.&.y.&.y.^.y.&.yFX.x.&.yFX.x.&.yFX.x.&.yFX.x.&.y.Y.x.&.y.&.y.&.y.^.x.&.y.Y.x.&.y.Y.x.&.y.Y}y.&.y.Y.x.&.yRich.&.y........PE..d....k.d.........." ...$.....<......0.....................................................`.........................................0D..`....D..x....p.......`.......X.../...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_overlapped.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):50968
                                                                                                                                                                                                    Entropy (8bit):6.433137711787963
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:A1MCcP4W1vqJiR5RMJl5XikC6r2lIsXtw5YiSyvUYAMxkEb:A1MiJifvkCllIsXti7SysGxf
                                                                                                                                                                                                    MD5:AC053EF737E4F13B02BFA81F9E46170B
                                                                                                                                                                                                    SHA1:5D8EBEB30671B74D736731696FEDC78C89DA0E1F
                                                                                                                                                                                                    SHA-256:CB68E10748E2EFD86F7495D647A2774CEA9F97AD5C6FE179F90DC1C467B9280F
                                                                                                                                                                                                    SHA-512:6AC26F63981DC5E8DFB675880D6C43648E2BBE6711C75DCAC20EBE4D8591E88FBFAC3C60660AB28602352760B6F5E1CB587075072ABD3333522E3E2549BFA02E
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........{.wo(.wo(.wo(...(.wo(..n).wo(..j).wo(..k).wo(..l).wo(..n).wo(.wn(.wo(..n).wo(..k).wo(..b).wo(..o).wo(...(.wo(..m).wo(Rich.wo(........................PE..d....k.d.........." ...$.B...X............................................................`.........................................0...X................................/......,....f..T...........................Pe..@............`...............................text...^A.......B.................. ..`.rdata..$5...`...6...F..............@..@.data................|..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_queue.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):32536
                                                                                                                                                                                                    Entropy (8bit):6.452372346765785
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:K+yFV6rXMmxU9tIsQUl5YiSyvYAMxkEl1C:K+wEXMWU9tIsQUr7SyexXC
                                                                                                                                                                                                    MD5:8BBED19359892F8C95C802C6AD7598E9
                                                                                                                                                                                                    SHA1:773FCA164965241F63170E7A1F3A8FA17F73EA18
                                                                                                                                                                                                    SHA-256:4E5B7C653C1B3DC3FD7519E4F39CC8A2FB2746E0ECDC4E433FE6029F5F4D9065
                                                                                                                                                                                                    SHA-512:22EA7667689A9F049FA34DDAE6B858E1AF3E646A379D2C5A4AEF3E74A4FF1A4109418B363C9BE960127F1C7E020AA393A47885BC45517C9E9AEBE71EC7CB61A0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7X.Y..Y..Y......Y.v.X..Y.v.\..Y.v.]..Y.v.Z..Y...X..Y...X..Y..X...Y...T..Y...Y..Y.....Y...[..Y.Rich.Y.........................PE..d....k.d.........." ...$.....8............................................................`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_socket.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):79640
                                                                                                                                                                                                    Entropy (8bit):6.290503224602847
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:zbflGOzI+Jmrc0r3uj+9/s+S+pzpDAiTFVf78tIsLwy7SyJx+:V/IMA3uj+9/sT+pztAYFVT8tIsLwyA
                                                                                                                                                                                                    MD5:64A6C475F59E5C57B3F4DD935F429F09
                                                                                                                                                                                                    SHA1:CA2E0719DC32F22163AE0E7B53B2CAADB0B9D023
                                                                                                                                                                                                    SHA-256:D03FA645CDE89B4B01F4A2577139FBB7E1392CB91DC26213B3B76419110D8E49
                                                                                                                                                                                                    SHA-512:CF9E03B7B34CC095FE05C465F9D794319AAA0428FE30AB4DDCE14BA78E835EDF228D11EC016FD31DFE9F09D84B6F73482FB8E0F574D1FD08943C1EC9E0584973
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........e...e...e.......e..N....e..N....e..N....e..N....e.......e...e..Re.......e.......e.......e....{..e.......e..Rich.e..................PE..d....l.d.........." ...$.l...........%.......................................P......e]....`.............................................P............0....... ..x......../...@..........T...............................@............................................text...6k.......l.................. ..`.rdata...t.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_ssl.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):176920
                                                                                                                                                                                                    Entropy (8bit):5.954664688637172
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:LFIQQShnmJg0ADm8H4qIOuXo6XHFBN9d41Olh59YL48PMrN/WgAlNzn5IsC7/1a:GShmaJDm24q6o6XHR4BLrT
                                                                                                                                                                                                    MD5:A0B40F1F8FC6656C5637EACACF7021F6
                                                                                                                                                                                                    SHA1:38813E25FFDE1EEE0B8154FA34AF635186A243C1
                                                                                                                                                                                                    SHA-256:79D861F0670828DEE06C2E3523E2F9A2A90D6C6996BDE38201425AA4003119F1
                                                                                                                                                                                                    SHA-512:C18855D7C0069FFF392D422E5B01FC518BBDF497EB3390C0B333ECAC2497CD29ABBDAE4557E4F0C4E90321FBA910FC3E4D235CE62B745FA34918F40FA667B713
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!...@.L.@.L.@.L.8$L.@.L.>.M.@.L.>.M.@.L.>.M.@.L.>.M.@.L.?.M.@.Lw=.M.@.L.@.L A.L.8.M.@.L.?.M.@.L.?.M.@.L.?HL.@.L.?.M.@.LRich.@.L........PE..d....l.d.........." ...$............l+....................................................`.........................................0...d................................/......|...P...T...............................@............................................text............................... ..`.rdata...".......$..................@..@.data...............................@....pdata...............\..............@..@.rsrc................h..............@..@.reloc..|............r..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\_uuid.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):25368
                                                                                                                                                                                                    Entropy (8bit):6.630514624008701
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:BfodpEWFfivQ5IsZwryHQIYiSy1pCQsmFlXAM+o/8E9VF0NywmV:BKpEC4Q5IsZwE5YiSyvhAMxkEdV
                                                                                                                                                                                                    MD5:4FAA479423C54D5BE2A103B46ECB4D04
                                                                                                                                                                                                    SHA1:011F6CDBD3BADAA5C969595985A9AD18547DD7EC
                                                                                                                                                                                                    SHA-256:C2AD3C1B4333BC388B6A22049C89008505C434B1B85BFF0823B19EF0CF48065A
                                                                                                                                                                                                    SHA-512:92D35824C30667AF606BBA883BF6E275F2A8B5CBFEA2E84A77E256D122B91B3EE7E84D9F4E2A4946E903A11293AF9648A45E8CFBE247CBDC3BCDEA92EB5349C6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p..r#..r#..r#...#..r#:.s"..r#:.w"..r#:.v"..r#:.q"..r#..s"..r#.s"..r#..s#..r#..z"..r#..r"..r#...#..r#..p"..r#Rich..r#........PE..d....k.d.........." ...$.....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info\INSTALLER

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                                    Entropy (8bit):1.5
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:Mn:M
                                                                                                                                                                                                    MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                    SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                    SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                    SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:pip.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info\METADATA

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (411)
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):11524
                                                                                                                                                                                                    Entropy (8bit):5.211520136058075
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:192:ERsUfi6bkQk+k/kKkegToJWicnJsPVA1oz2dv7COmoKTACoEJdQ/0G6lWg+JdQV5:ERsXpLs3VoJWRnJsPvz2dDCHoKsLgA6z
                                                                                                                                                                                                    MD5:49CABCB5F8DA14C72C8C3D00ADB3C115
                                                                                                                                                                                                    SHA1:F575BECF993ECDF9C6E43190C1CB74D3556CF912
                                                                                                                                                                                                    SHA-256:DC9824E25AFD635480A8073038B3CDFE6A56D3073A54E1A6FB21EDD4BB0F207C
                                                                                                                                                                                                    SHA-512:923DAEEE0861611D230DF263577B3C382AE26400CA5F1830EE309BD6737EED2AD934010D61CDD4796618BEDB3436CD772D9429A5BED0A106EF7DE60E114E505C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Metadata-Version: 2.3.Name: attrs.Version: 24.2.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: GitHub, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classifier: Programming Languag

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info\RECORD

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):3556
                                                                                                                                                                                                    Entropy (8bit):5.810477636970161
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Q9ewrFmJT/oPynEddwBbCobXm9qGmR5VXzskCGD+qLtxO:2ewBoJCKXGeR/XzIiO
                                                                                                                                                                                                    MD5:8037E693EAFED6C3D0CCE916BABB50C4
                                                                                                                                                                                                    SHA1:2321392AAB7AE3A6A78248E5D5F454124D368EC1
                                                                                                                                                                                                    SHA-256:688073F6556808D9139FEA52BEC3802D8C0D7CE07978B98AAE8DB5C98FACC0DF
                                                                                                                                                                                                    SHA-512:95B9E6B8F946D2617098C338441AFC5A555FF208947D5731E09EE17B959655161C397F57E14827A95A8FD4554DE8C6E426DC316F858510AE4AA7CA8723C4CF51
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:attr/__init__.py,sha256=l8Ewh5KZE7CCY0i1iDfSCnFiUTIkBVoqsXjX9EZnIVA,2087..attr/__init__.pyi,sha256=aTVHBPX6krCGvbQvOl_UKqEzmi2HFsaIVm2WKmAiqVs,11434..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=3umHiBtgsEYtvNP_8XrQwTCdFoZIX4DEur76N-2a3X8,4123..attr/_cmp.pyi,sha256=U-_RU_UZOyPUEQzXE6RMYQQcjkZRY25wTH99sN0s7MM,368..attr/_compat.py,sha256=n2Uk3c-ywv0PkFfGlvqR7SzDXp4NOhWmNV_ZK6YfWoM,2958..attr/_config.py,sha256=z81Vt-GeT_2taxs1XZfmHx9TWlSxjP

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info\WHEEL

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):87
                                                                                                                                                                                                    Entropy (8bit):4.730668933656452
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:RtEeXAaCTQnP+tPCCfA5I:Rt2PcnWBB3
                                                                                                                                                                                                    MD5:52ADFA0C417902EE8F0C3D1CA2372AC3
                                                                                                                                                                                                    SHA1:B67635615EEF7E869D74F4813B5DC576104825DD
                                                                                                                                                                                                    SHA-256:D7215D7625CC9AF60AED0613AAD44DB57EBA589D0CCFC3D8122114A0E514C516
                                                                                                                                                                                                    SHA-512:BFA87E7B0E76E544C2108EF40B9FAC8C5FF4327AB8EDE9FEB2891BD5D38FEA117BD9EEBAF62F6C357B4DEADDAD5A5220E0B4A54078C8C2DE34CB1DD5E00F2D62
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:Wheel-Version: 1.0.Generator: hatchling 1.25.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\attrs-24.2.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1109
                                                                                                                                                                                                    Entropy (8bit):5.104415762129373
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                    MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                    SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                    SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                    SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\base_library.zip

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1438582
                                                                                                                                                                                                    Entropy (8bit):5.5907231375545905
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:24576:DQR5pATuFfR5lUKdcubgAnyPbadDUiwhtdYfXP3eFHHU:DQR5pnfRLDl
                                                                                                                                                                                                    MD5:1E65F6C9ED52BA79F93C0D0395CBD591
                                                                                                                                                                                                    SHA1:0F30BD8BAEFE9876A7973AABD86B003C31EE869F
                                                                                                                                                                                                    SHA-256:B5FDDA23550867243F1B8DF3818B955255685660D61A15AAB8F5DE1A49735D9D
                                                                                                                                                                                                    SHA-512:51074C9D578CE0B03CD92338DAE929D290C2BB5BD8893268BC7B9DE6A7F8ADA62D2DEA999EE80AD3C8441736B01017B23D9BFC6CECC23488D87E4413143D62EA
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:PK..........!.W*..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\certifi\cacert.pem

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):299427
                                                                                                                                                                                                    Entropy (8bit):6.047872935262006
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                    MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                    SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                    SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                    SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):10752
                                                                                                                                                                                                    Entropy (8bit):4.8208567868970675
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
                                                                                                                                                                                                    MD5:CBF62E25E6E036D3AB1946DBAFF114C1
                                                                                                                                                                                                    SHA1:B35F91EAF4627311B56707EF12E05D6D435A4248
                                                                                                                                                                                                    SHA-256:06032E64E1561251EA3035112785F43945B1E959A9BF586C35C9EA1C59585C37
                                                                                                                                                                                                    SHA-512:04B694D0AE99D5786FA19F03C5B4DD8124C4F9144CFE7CA250B48A3C0DE0883E06A6319351AE93EA95B55BBBFA69525A91E9407478E40AD62951F1D63D45FF18
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................X......o..............o.......o.......o......j..............n......n......n4.....n......Rich....................PE..d....#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):121344
                                                                                                                                                                                                    Entropy (8bit):5.899699901799497
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
                                                                                                                                                                                                    MD5:BAC273806F46CFFB94A84D7B4CED6027
                                                                                                                                                                                                    SHA1:773FBC0435196C8123EE89B0A2FC4D44241FF063
                                                                                                                                                                                                    SHA-256:1D9ABA3FF1156EA1FBE10B8AA201D4565AE6022DAF2117390D1D8197B80BB70B
                                                                                                                                                                                                    SHA-512:EAEC1F072C2C0BC439AC7B4E3AEA6E75C07BD4CD2D653BE8500BBFFE371FBFE045227DAEAD653C162D972CCAADFF18AC7DA4D366D1200618B0291D76E18B125C
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB............................................................................................Rich...........................PE..d....#.g.........." ...).2..........@4.......................................0............`.............................................d...d...................p............ ......@...................................@............P...............................text...x0.......2.................. ..`.rdata...Y...P...Z...6..............@..@.data....=.......0..................@....pdata..p...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\libcrypto-3.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5157656
                                                                                                                                                                                                    Entropy (8bit):5.95816549046812
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:OH+jTaoFABs2NPAE7uLcdKmj8waP31CPwDvt3uFlDC:kQ+Bs2NQcdKmj8waP1CPwDvt3uFlDC
                                                                                                                                                                                                    MD5:7A6A8C2A8C379B111CDCEB66B18D687D
                                                                                                                                                                                                    SHA1:F3B8A4C731FA0145F224112F91F046FDDF642794
                                                                                                                                                                                                    SHA-256:8E13B53EE25825B97F191D77B51ED03966F8B435773FA3FBC36F3EB668FC569B
                                                                                                                                                                                                    SHA-512:F2EF1702DF861EF55EF397AD69985D62B675D348CAB3862F6CA761F1CE3EE896F663A77D7B69B286BE64E7C69BE1215B03945781450B186FC02CFB1E4CB226B5
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d......d.........." ...#..6..&......v.........................................O......eO...`..........................................zG.0.....M.@.... N.s.....K......N../...0N......bC.8...........................0aC.@.............M..............................text...t.6.......6................. ..`.rdata........6.......6.............@..@.data....n....J..<...vJ.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.....N.......M.............@..@.rsrc...s.... N.......M.............@..@.reloc..S....0N.......M.............@..B................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\libffi-8.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):39696
                                                                                                                                                                                                    Entropy (8bit):6.641880464695502
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                    MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                    SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                    SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                    SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\libssl-3.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):789784
                                                                                                                                                                                                    Entropy (8bit):5.607345956416271
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:9jurAr6yUDGpdXh3Mr3r0oARnjmeUl4XOnZiRtw036WgfCBL5JyJ/OiFe9XbI:9MT6h3M7VxKXOrqdeOiFe9Xb
                                                                                                                                                                                                    MD5:64ACB046FE68D64EE475E19F67253A3C
                                                                                                                                                                                                    SHA1:D9E66C9437CE6F775189D6FDBD171635193EC4CC
                                                                                                                                                                                                    SHA-256:B21309ABD3DBBB1BF8FB6AA3C250FC85D7B0D9984BF4C942D1D4421502F31A10
                                                                                                                                                                                                    SHA-512:F8B583981DF528CF4F1854B94EFF6F51DD9D4BE91E6FA6329A8C4435B705457C868AE40EE030FA54BEBB646A37B547BC182C9CBF0DF9A07FEA03A18CF85C6766
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...T...T...].3.Z......V......V......X......\......P.....W...T...H.....e.....U...._.U.....U...RichT...................PE..d....d.........." ...#.4..........K........................................0...........`..........................................x...Q..............i.... ..|M......./......`.......8...............................@............................................text...D3.......4.................. ..`.rdata...y...P...z...8..............@..@.data....N.......H..................@....pdata..dV... ...X..................@..@.idata...c.......d...R..............@..@.00cfg..u...........................@..@.rsrc...i...........................@..@.reloc..?...........................@..B........................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\multidict\_multidict.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):47616
                                                                                                                                                                                                    Entropy (8bit):5.315276044408234
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:j2vE6F6hmSrnDe651sYEYMXB/6BvE6n0/d3g:jAoVDeWlE5/6BvDni
                                                                                                                                                                                                    MD5:ECC0B2FCDA0485900F4B72B378FE4303
                                                                                                                                                                                                    SHA1:40D9571B8927C44AF39F9D2AF8821F073520E65A
                                                                                                                                                                                                    SHA-256:BCBB43CE216E38361CB108E99BAB86AE2C0F8930C86D12CADFCA703E26003CB1
                                                                                                                                                                                                    SHA-512:24FD07EB0149CB8587200C055F20FF8C260B8E626693C180CBA4E066194BED7E8721DDE758B583C93F7CB3D691B50DE6179BA86821414315C17B3D084D290E70
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~..T:l..:l..:l..3.?.8l..*..8l..q...8l..*..9l..*..2l..*..6l..U..9l..:l..Ll..r..;l..r..;l..r.S.;l..r..;l..Rich:l..........................PE..d...;}.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\propcache\_helpers_c.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):73728
                                                                                                                                                                                                    Entropy (8bit):5.828839746531406
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:SIjsHKa66nI3YeD+ElE0Dhhll7mjnQjZVUSdCGbbpyd:vgHKaI3YpMEIfllW4ZOSdCGbbpyd
                                                                                                                                                                                                    MD5:A263633F7D5F6B0AC882ADC23A19BC7F
                                                                                                                                                                                                    SHA1:26785740B2B9452DAD22AD6573130FA774198F57
                                                                                                                                                                                                    SHA-256:3D297D27CE61A6891DB6308EB07DCE20A4E80F88B49A0F4C12EC4CA21CB71136
                                                                                                                                                                                                    SHA-512:8397EB4BB3592565FC4178D7EC947588A2F91B56B692CFB5129F6364E914D1880C65CF1F328BA8DB14DE8F6EA5E5A87E86B662F39740970B7FEC8B44209A7778
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..Tn...n...n...g.].l....E..l....B..l....E..m....E..f....E..b....B..m...n........E..o....E..o....E1.o....E..o...Richn...........PE..d....Lg.........." ...*.....n......p........................................p............`.............................................d...4...d....P.......@..H............`..X...................................@...@............................................text.............................. ..`.rdata..XF.......H..................@..@.data........ ......................@....pdata..H....@......................@..@.rsrc........P......................@..@.reloc..X....`......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\pyexpat.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):199448
                                                                                                                                                                                                    Entropy (8bit):6.374698779434704
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3072:ZKABBH4pwa0bGheNSeFPyP7pgE7xhAq36exBce56iXfVhyAJ1Ohc2gZtIsLh5Aj:ZBBHCqGheNSe9YeE7/AqV1XfPym2yk
                                                                                                                                                                                                    MD5:CDCF0E74A32AD7DFEDA859A0CE4FCB20
                                                                                                                                                                                                    SHA1:C72B42A59BA5D83E8D481C6F05B917871B415F25
                                                                                                                                                                                                    SHA-256:91FE5B1B2DE2847946E5B3F060678971D8127DFD7D2D37603FDCD31BD5C71197
                                                                                                                                                                                                    SHA-512:C26FDF57299B2C6085F1166B49BD9608D2DD8BC804034EBB03FB2BBA6337206B6018BF7F74C069493FFAE42F2E9D6337F6F7DF5306B80B63C8C3A386BCE69EA6
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.]...3...3...3.......3...2...3...6...3...7...3...0...3...2...3.L.2...3...2.s.3...>...3...3...3......3...1...3.Rich..3.........PE..d....k.d.........." ...$..................................................... ............`.............................................P................................/..........`3..T........................... 2..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...@!..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\python3.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):67352
                                                                                                                                                                                                    Entropy (8bit):6.145559867069682
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:768:ow/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS7:P/5k8cnzeJptIsL0t7Sym1xm
                                                                                                                                                                                                    MD5:0E105F62FDD1FF4157560FE38512220B
                                                                                                                                                                                                    SHA1:99BD69A94B3DC99FE2C0F7BBBCD05AA0BC8CD45C
                                                                                                                                                                                                    SHA-256:803BA8242B409080DF166320C05A4402AAB6DD30E31C4389871F4B68CA1AD423
                                                                                                                                                                                                    SHA-512:59C0F749ED9C59EFDBCD04265B4985B1175FDD825E5A307745531ED2537397E739BC9290FDC3936CFD04F566E28BB76B878F124248B8344CF74F641C6B1101DE
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,e..,e..,e..Sm..,e..Se..,e..S...,e..Sg..,e.Rich.,e.........PE..d....k.d.........." ...$............................................................4.....`.........................................`...P................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\python311.dll

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):5765912
                                                                                                                                                                                                    Entropy (8bit):6.089565479797802
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:98304:BBduVia4N3NWLvJP8IjF/d/aHMMwuPQyFF+RdioiZPbwappjDq:BBduVv4N3ILvJ8M/4wZy3+RdioiZPbwl
                                                                                                                                                                                                    MD5:58E01ABC9C9B5C885635180ED104FE95
                                                                                                                                                                                                    SHA1:1C2F7216B125539D63BD111A7ABA615C69DEB8BA
                                                                                                                                                                                                    SHA-256:DE1B95D2E951FC048C84684BC7DF4346138910544EE335B61FC8E65F360C3837
                                                                                                                                                                                                    SHA-512:CD32C77191309D99AEED47699501B357B35669123F0DD70ED97C3791A009D1855AB27162DB24A4BD9E719B68EE3B0539EE6DB88E71ABB9A2D4D629F87BC2C081
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Ed..Ed..Ed......Gd......Kd......Id......Md......Ad..L.{._d......Nd..Ed.. e.._...d.._...Dd.._...Dd.._...Dd..RichEd..................PE..d....k.d.........." ...$.`%..87......K........................................\.....nMX...`...........................................@......ZA......p[.......V..0....W../....[..B....).T...........................`.).@............p%..............................text...._%......`%................. ..`.rdata.......p%......d%.............@..@.data.........A..L...tA.............@....pdata...0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......~V.............@..@.reloc...B....[..D....V.............@..B................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\select.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):30488
                                                                                                                                                                                                    Entropy (8bit):6.586478365575897
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:384:dEeecReJKuHq1W57AvB0EZtIsQGQHQIYiSy1pCQvC5HAM+o/8E9VF0Ny5X3:XeUeJPHqoGDtIsQGq5YiSyvmAMxkE/3
                                                                                                                                                                                                    MD5:653BDCCB7AF2AA9CCF50CB050FD3BE64
                                                                                                                                                                                                    SHA1:AFE0A85425AE911694C250AB4CB1F6C3D3F2CC69
                                                                                                                                                                                                    SHA-256:E24A3E7885DF9A18C29BA058C49C3ADCF59E4B58107847B98ECA365B6D94F279
                                                                                                                                                                                                    SHA-512:07E841FDA7A2295380BFA05DB7A4699F18C6E639DA91D8EE2D126D4F96E4CDDAEDBD490DEB4D2A2E8E5877EDFFF877693F67A9DC487E29742943E062D7BE6277
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........t..'..'..'...'..'...&..'...&..'...&..'...&..'...&..'..'..'...&..'...&..'...&..'..c'..'...&..'Rich..'........................PE..d....k.d.........." ...$.....2......................................................;.....`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\unicodedata.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):1141016
                                                                                                                                                                                                    Entropy (8bit):5.435066249596469
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:P3EYbfjwR6nbsonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1JD:PUYbMB0IDJcjEwPgPOG6Xyd461JD
                                                                                                                                                                                                    MD5:1905B5D0F945499441E8CD58EB123D86
                                                                                                                                                                                                    SHA1:117E584E6FCC0E8CFC8E24E3AF527999F14BAC30
                                                                                                                                                                                                    SHA-256:B1788B81FA160E5120451F9252C7745CDDE98B8CE59BF273A3DD867BB034C532
                                                                                                                                                                                                    SHA-512:ED88CD7E3259239A0C8D42D95FA2447FC454A944C849FA97449AD88871236FEFDAFE21DBFA6E9B5D8A54DDF1D5281EC34D314CB93D47CE7B13912A69D284F522
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D|............eG.....c.....c.....c.....c.....b....Ke.......Q...b.....b.....b+.....b....Rich...........................PE..d....k.d.........." ...$.@..........P*..............................................J.....`.............................................X............`.......P..0....:.../...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\yarl\_quoting_c.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):97280
                                                                                                                                                                                                    Entropy (8bit):5.966412260554208
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:1536:TaN8DbzRiH4vvKMbyRk0edYfOLRBLdQ8hC4go1CzeTg5RRNpp:2N890U2Rk0GrQSfCzeERRN
                                                                                                                                                                                                    MD5:17B333181C4286E91DFEE9D182DED637
                                                                                                                                                                                                    SHA1:09BFD38B4F46C5B9D118BD9943920AB4B4058CCD
                                                                                                                                                                                                    SHA-256:36975A42953E5B6DEA22F1398C20CC44C4881E3E16EEF0CA757C27E969ECC6B0
                                                                                                                                                                                                    SHA-512:A0AC829170AC6424B53AE7FAC580E2CEDC77B2BDDB6A24437542E20E7EF65270F53DCDEDD920FFBAEBE8BF5E32A2B4F2FE9DB76D2C729A6022E2B88DB74EB1BB
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].c...c...c....)..c......c......c......c......c......c......c...c...c..W...c..W...c..W.E..c..W...c..Rich.c..................PE..d...G.Lg.........." ...*............`.....................................................`..........................................Y..d....Y..x...............................,....G...............................F..@............ ...............................text............................... ..`.rdata..nN... ...P..................@..@.data...P7...p.......`..............@....pdata...............l..............@..@.rsrc................x..............@..@.reloc..,............z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\_cffi.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):650752
                                                                                                                                                                                                    Entropy (8bit):6.4073215909095005
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6144:rbTutDqcmbgSZZ/jZMaBHXD/OHHSAU1gIkpWCuMshv9K1HFV1jBjgG4LFxJY/1n:rfrcmsSHBHXiSArRENMivwF1jdgs/1n
                                                                                                                                                                                                    MD5:A19B5E6324D1A6A9FD99C98FE7B83FE2
                                                                                                                                                                                                    SHA1:4E3E56754A3C46C661EF591A4B5A5985BD4F6B85
                                                                                                                                                                                                    SHA-256:3ED00BB5876EAFA617BEBB213D2BC887B5637C53C4A849FCC2366084BF056787
                                                                                                                                                                                                    SHA-512:5975F90036CB7D3013FC6815F2C372EB9B89AF6C8153D1770EBBD70BF5B61E3B12DEFA3D7A4CCD364BD6A978B2879A15801D2AEC8BAD9221CA15DFFC9B7BA929
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................1....!X............!X.....!X.....!X......Z............_......_......_]....._.....Rich...........................PE..d...B'.f.........." ...(.....\...... ........................................0............`.........................................0...\........................3........... .......d..............................Pc..@...............@............................text...H........................... ..`.rdata..b...........................@..@.data...............................@....pdata...3.......4..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI79202\zstandard\backend_c.cp311-win_amd64.pyd

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):519680
                                                                                                                                                                                                    Entropy (8bit):6.407145343537454
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:12288:n5vDYEvt0Fwyow0k1rErp645rtxvi1gRNg5sXgz0:npBvt0Fw9fk1rErQ45rt5RNZ
                                                                                                                                                                                                    MD5:56DB4A861AEC914A860461DEDCDCA0A0
                                                                                                                                                                                                    SHA1:8535A8C9EAC371A54308795A8BBE89414933E035
                                                                                                                                                                                                    SHA-256:6AB611C4A24406D9D97F09D49D50142AB2734B69A2B0D9EA6489E4AF90C4A2A4
                                                                                                                                                                                                    SHA-512:600A21666E9ED334DE5B4B17F60136434EE485C80F9740E6085E24EF95CA5376E6223A54C6B1C8F12987EDAB5D89AF9676CC12E2A335F4C4E9AB79DFEF8E4B90
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................P.............P......P......P......R........4...W......W......Wn.....W.....Rich...........PE..d...<'.f.........." ...(............ ........................................0............`.............................................d...D....................)........... ..d...0\...............................Z..@...............(............................text...H........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata...).......*..................@..@.rsrc...............................@..@.reloc..d.... ......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                    C:\Users\user\Desktop\bot_log.txt

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):399
                                                                                                                                                                                                    Entropy (8bit):5.12377620861427
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:6:lQS5ukjOBJWT59IOg685u/8M05K89rwFmh+ObRbJlkjIOGMnEE64xOGQTn/Vcdv:l5KE5g8s5KecuD+j5CX/qv
                                                                                                                                                                                                    MD5:07B79F87F2541D83ED15CB68AE6519AF
                                                                                                                                                                                                    SHA1:3D1AA7EC8F5CD485966CB50FA195AE31503C9043
                                                                                                                                                                                                    SHA-256:B2E1A38EA85FD0836D2E7864A1D2DC4F9CD02FAFA951D77D3DF3950D219D7987
                                                                                                                                                                                                    SHA-512:5FB3466F38E3E17BFF5E6CF79D59F58858CD1D22209FD36D4915E9F1DAC503571E5385393CCB61D848E1BE6588F44DA0D9F2B83B377255A8BFFEDDC14F8B8A11
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:2024-12-13 02:36:56,132 - discord.client - WARNING - PyNaCl is not installed, voice will NOT be supported..2024-12-13 02:36:56,397 - discord.client - DEBUG - on_ready has successfully been registered as an event..2024-12-13 02:36:56,819 - asyncio - DEBUG - Using proactor: IocpProactor..2024-12-13 02:36:57,100 - urllib3.connectionpool - DEBUG - Starting new HTTPS connection (1): pastebin.com:443..

                                                                                                                                                                                                    C:\Users\user\Desktop\config.ini

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):38
                                                                                                                                                                                                    Entropy (8bit):4.290966250901474
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:clEFdlRY8IhIvn:ceFdlRYLhIvn
                                                                                                                                                                                                    MD5:313E26340FDFC7C510D910F3465706DC
                                                                                                                                                                                                    SHA1:059B0C9F5CB97A5E44EA176A62A1B1ADE2D565AA
                                                                                                                                                                                                    SHA-256:BB7786C7A0AF5247DD533602F0D89F5A11A26242ACE7E2770C73FFE745F1E66F
                                                                                                                                                                                                    SHA-512:CA88727BD3B02C7AB0BD600F34F04FC99F5532C86E89341266B85E23B3F612BE2D50E8D5F7E9069D11AE341920D75DEF3D0FD3040663BD920175FEF7C9A0BE20
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[Xeecida Nuke]..TOKEN = ..GUILD = ....

                                                                                                                                                                                                    \Device\ConDrv

                                                                                                                                                                                                    Download File
                                                                                                                                                                                                    Process:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                    Size (bytes):78
                                                                                                                                                                                                    Entropy (8bit):4.72240987273103
                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                    SSDEEP:3:dBFReNmI4S2UUAuF5QEyn:ZMmI4S2UP3
                                                                                                                                                                                                    MD5:7CCA1CACA8456E44D63EBE21377B8CE9
                                                                                                                                                                                                    SHA1:9608DDC0BE5607DCB0DA4F080AA993D49F6214C6
                                                                                                                                                                                                    SHA-256:AE4FA6760D94F57502584337D14E2CC21DD7BFC74416E5618D618DE692A458C1
                                                                                                                                                                                                    SHA-512:D094F8CC222E45E3A299996613ACDD221B28607BC83479627E70914F4AFD5C7117F2B8F883DF59064B16F2E122AD8450074E304E8AB4CA562C496900BA43A2D9
                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                    Preview:[PYI-8060:ERROR] Failed to execute script 'main' due to unhandled exception!..

                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                    Entropy (8bit):7.966032812809042
                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                    • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                                                                    • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                    File name:main.exe
                                                                                                                                                                                                    File size:12'170'881 bytes
                                                                                                                                                                                                    MD5:641d3930a194bf84385372c84605207c
                                                                                                                                                                                                    SHA1:90b6790059fc9944a338af1529933d8e2825cc36
                                                                                                                                                                                                    SHA256:93db434151816b6772c378f9fee5ac962ddce54458ac5dd1b16622d3a407224a
                                                                                                                                                                                                    SHA512:19d676e63bd6478969a75e84c1eeb676da0ad304ef3b08014e426f5ac45678d28f74ee907dce95d1886a67336301da2e3e727bd19404775436480c893fd01b85
                                                                                                                                                                                                    SSDEEP:196608:QMr63/DiJFDwGcsAgestcGfcY3gtANyi9UONTeuPtCwuL7P:J6vDAk3meGcGfdJyi9CuPMLr
                                                                                                                                                                                                    TLSH:1BC63365A3690868DEA32639C180C675EAB17C9D2394C38F12F48E573F236D52D3DFA1
                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xh.B<...<...<...wq..;...wq......wq..6...,.W.>...,...5...,...-...,.......wq..;...<.......w...%...w...=...Rich<...........PE..d..

                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                    Icon Hash:0092e06cfcbc1008

                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Entrypoint:0x14000c380
                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                    Imagebase:0x140000000
                                                                                                                                                                                                    Subsystem:windows cui
                                                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                    DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                    Time Stamp:0x675122A9 [Thu Dec 5 03:48:57 2024 UTC]
                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                    OS Version Major:6
                                                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                                                    File Version Major:6
                                                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                                                    Subsystem Version Major:6
                                                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                                                    Import Hash:a06f302f71edd380da3d5bf4a6d94ebd

                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                                    call 00007F8C650C709Ch
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                                    jmp 00007F8C650C6CAFh
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                                    call 00007F8C650C7428h
                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                    je 00007F8C650C6E63h
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    mov eax, dword ptr [00000030h]
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                    jmp 00007F8C650C6E47h
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    cmp ecx, eax
                                                                                                                                                                                                    je 00007F8C650C6E56h
                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    cmpxchg dword ptr [000381ACh], ecx
                                                                                                                                                                                                    jne 00007F8C650C6E30h
                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                                    jmp 00007F8C650C6E39h
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                                    test ecx, ecx
                                                                                                                                                                                                    jne 00007F8C650C6E49h
                                                                                                                                                                                                    mov byte ptr [00038195h], 00000001h
                                                                                                                                                                                                    call 00007F8C650C6585h
                                                                                                                                                                                                    call 00007F8C650C7840h
                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                    jne 00007F8C650C6E46h
                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                    jmp 00007F8C650C6E56h
                                                                                                                                                                                                    call 00007F8C650D5D4Fh
                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                    jne 00007F8C650C6E4Bh
                                                                                                                                                                                                    xor ecx, ecx
                                                                                                                                                                                                    call 00007F8C650C7850h
                                                                                                                                                                                                    jmp 00007F8C650C6E2Ch
                                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                                    ret
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    int3
                                                                                                                                                                                                    inc eax
                                                                                                                                                                                                    push ebx
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                                    cmp byte ptr [0003815Ch], 00000000h
                                                                                                                                                                                                    mov ebx, ecx
                                                                                                                                                                                                    jne 00007F8C650C6EA9h
                                                                                                                                                                                                    cmp ecx, 01h
                                                                                                                                                                                                    jnbe 00007F8C650C6EACh
                                                                                                                                                                                                    call 00007F8C650C739Eh
                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                    je 00007F8C650C6E6Ah
                                                                                                                                                                                                    test ebx, ebx
                                                                                                                                                                                                    jne 00007F8C650C6E66h
                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                    lea ecx, dword ptr [00038146h]
                                                                                                                                                                                                    call 00007F8C650D5B42h

                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x3e9ec0x50.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x490000x42634.rsrc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x460000x22bc.pdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x8c0000x768.reloc
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x3bfb00x1c.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3be700x140.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x2d0000x400.rdata
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                    Sections

                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                    .text0x10000x2b1700x2b200420661550c659f884db561712e500aaeFalse0.5455615942028985data6.498595774489571IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .rdata0x2d0000x128020x12a000313a2df78807636d44a0a3ee189be05False0.5229262793624161data5.7684514633150075IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .data0x400000x54080xe00aff56347f897785154c53727472c548dFalse0.13504464285714285data1.8315705466577277IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                    .pdata0x460000x22bc0x24002411a276649fc67a0a93227155911735False0.4740668402777778data5.334571311334213IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .rsrc0x490000x426340x4280040bdb02bae816b3e8e6048a55c2d603aFalse0.17804643444548873data2.4169662267331713IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                    .reloc0x8c0000x7680x80042d6242177dbae8e11ed5d64b87d0d48False0.5576171875data5.268722219019965IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                    Resources

                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                    RT_ICON0x490e80x42028Device independent bitmap graphic, 256 x 512 x 32, image size 2621440.17619167381720272
                                                                                                                                                                                                    RT_GROUP_ICON0x8b1100x14data1.1
                                                                                                                                                                                                    RT_MANIFEST0x8b1240x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                    Imports

                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                    USER32.dllTranslateMessage, ShutdownBlockReasonCreate, GetWindowThreadProcessId, SetWindowLongPtrW, GetWindowLongPtrW, MsgWaitForMultipleObjects, ShowWindow, DestroyWindow, CreateWindowExW, RegisterClassW, DefWindowProcW, PeekMessageW, DispatchMessageW, GetMessageW
                                                                                                                                                                                                    KERNEL32.dllGetTimeZoneInformation, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, GetStringTypeW, FormatMessageW, GetLastError, GetModuleFileNameW, LoadLibraryExW, SetDllDirectoryW, CreateSymbolicLinkW, GetProcAddress, CreateDirectoryW, GetCommandLineW, GetEnvironmentVariableW, ExpandEnvironmentStringsW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, HeapSize, RemoveDirectoryW, GetTempPathW, CloseHandle, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObject, Sleep, GetCurrentProcess, GetCurrentProcessId, TerminateProcess, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LocalFree, SetConsoleCtrlHandler, GetConsoleWindow, K32EnumProcessModules, K32GetModuleFileNameExW, CreateFileW, FindFirstFileExW, GetFinalPathNameByHandleW, MultiByteToWideChar, WideCharToMultiByte, GetFileAttributesExW, HeapReAlloc, WriteConsoleW, SetEndOfFile, GetDriveTypeW, IsDebuggerPresent, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, ReadFile, GetFullPathNameW, SetStdHandle, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetCommandLineA, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, SetEnvironmentVariableW
                                                                                                                                                                                                    ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.039613008 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.039654016 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.039716959 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.040569067 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.040585995 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.258167028 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.332392931 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.332426071 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.334038973 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.334054947 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.334111929 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.336613894 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.336806059 CET44349709104.20.4.235192.168.2.8
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.336857080 CET49709443192.168.2.8104.20.4.235
                                                                                                                                                                                                    Dec 13, 2024 08:36:59.336915016 CET49709443192.168.2.8104.20.4.235

                                                                                                                                                                                                    UDP Packets

                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                    Dec 13, 2024 08:36:57.898971081 CET5299553192.168.2.81.1.1.1
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.036207914 CET53529951.1.1.1192.168.2.8

                                                                                                                                                                                                    DNS Queries

                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                    Dec 13, 2024 08:36:57.898971081 CET192.168.2.81.1.1.10xc8b3Standard query (0)pastebin.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                    DNS Answers

                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.036207914 CET1.1.1.1192.168.2.80xc8b3No error (0)pastebin.com104.20.4.235A (IP address)IN (0x0001)false
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.036207914 CET1.1.1.1192.168.2.80xc8b3No error (0)pastebin.com104.20.3.235A (IP address)IN (0x0001)false
                                                                                                                                                                                                    Dec 13, 2024 08:36:58.036207914 CET1.1.1.1192.168.2.80xc8b3No error (0)pastebin.com172.67.19.24A (IP address)IN (0x0001)false

                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                    Start time:02:36:49
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\main.exe"
                                                                                                                                                                                                    Imagebase:0x7ff784e40000
                                                                                                                                                                                                    File size:12'170'881 bytes
                                                                                                                                                                                                    MD5 hash:641D3930A194BF84385372C84605207C
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                    Start time:02:36:49
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:3
                                                                                                                                                                                                    Start time:02:36:51
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:"C:\Users\user\Desktop\main.exe"
                                                                                                                                                                                                    Imagebase:0x7ff784e40000
                                                                                                                                                                                                    File size:12'170'881 bytes
                                                                                                                                                                                                    MD5 hash:641D3930A194BF84385372C84605207C
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:4
                                                                                                                                                                                                    Start time:02:36:54
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c
                                                                                                                                                                                                    Imagebase:0x7ff633d70000
                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                    Start time:02:36:56
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c
                                                                                                                                                                                                    Imagebase:0x7ff633d70000
                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                                    Start time:02:36:56
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c
                                                                                                                                                                                                    Imagebase:0x7ff633d70000
                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:7
                                                                                                                                                                                                    Start time:02:36:56
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c mode con: cols=125 lines=35
                                                                                                                                                                                                    Imagebase:0x7ff633d70000
                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:8
                                                                                                                                                                                                    Start time:02:36:56
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\mode.com
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:mode con: cols=125 lines=35
                                                                                                                                                                                                    Imagebase:0x7ff60a910000
                                                                                                                                                                                                    File size:33'280 bytes
                                                                                                                                                                                                    MD5 hash:BEA7464830980BF7C0490307DB4FC875
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    General

                                                                                                                                                                                                    Target ID:9
                                                                                                                                                                                                    Start time:02:36:57
                                                                                                                                                                                                    Start date:13/12/2024
                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c cls
                                                                                                                                                                                                    Imagebase:0x7ff633d70000
                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:9.9%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:16.1%
                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                      Total number of Limit Nodes:60
                                                                                                                                                                                                      execution_graph 21025 7ff784e4c110 21026 7ff784e4c120 21025->21026 21042 7ff784e5aae0 21026->21042 21028 7ff784e4c12c 21048 7ff784e4c418 21028->21048 21030 7ff784e4c199 21031 7ff784e4c6fc 7 API calls 21030->21031 21041 7ff784e4c1b5 21030->21041 21033 7ff784e4c1c5 21031->21033 21032 7ff784e4c144 _RTC_Initialize 21032->21030 21053 7ff784e4c5c8 21032->21053 21035 7ff784e4c159 21056 7ff784e59f50 21035->21056 21043 7ff784e5aaf1 21042->21043 21044 7ff784e5aaf9 21043->21044 21045 7ff784e55e48 _get_daylight 11 API calls 21043->21045 21044->21028 21046 7ff784e5ab08 21045->21046 21047 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 21046->21047 21047->21044 21049 7ff784e4c429 21048->21049 21052 7ff784e4c42e __scrt_acquire_startup_lock 21048->21052 21050 7ff784e4c6fc 7 API calls 21049->21050 21049->21052 21051 7ff784e4c4a2 21050->21051 21052->21032 21081 7ff784e4c58c 21053->21081 21055 7ff784e4c5d1 21055->21035 21057 7ff784e59f70 21056->21057 21064 7ff784e4c165 21056->21064 21058 7ff784e59f8e GetModuleFileNameW 21057->21058 21059 7ff784e59f78 21057->21059 21063 7ff784e59fb9 21058->21063 21060 7ff784e55e48 _get_daylight 11 API calls 21059->21060 21061 7ff784e59f7d 21060->21061 21062 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 21061->21062 21062->21064 21096 7ff784e59ef0 21063->21096 21064->21030 21080 7ff784e4c69c InitializeSListHead 21064->21080 21067 7ff784e5a001 21068 7ff784e55e48 _get_daylight 11 API calls 21067->21068 21069 7ff784e5a006 21068->21069 21070 7ff784e5b464 __free_lconv_num 11 API calls 21069->21070 21070->21064 21071 7ff784e5a03b 21073 7ff784e5b464 __free_lconv_num 11 API calls 21071->21073 21072 7ff784e5a019 21072->21071 21074 7ff784e5a067 21072->21074 21075 7ff784e5a080 21072->21075 21073->21064 21076 7ff784e5b464 __free_lconv_num 11 API calls 21074->21076 21078 7ff784e5b464 __free_lconv_num 11 API calls 21075->21078 21077 7ff784e5a070 21076->21077 21079 7ff784e5b464 __free_lconv_num 11 API calls 21077->21079 21078->21071 21079->21064 21082 7ff784e4c5a6 21081->21082 21084 7ff784e4c59f 21081->21084 21085 7ff784e5b16c 21082->21085 21084->21055 21088 7ff784e5ada8 21085->21088 21095 7ff784e61548 EnterCriticalSection 21088->21095 21097 7ff784e59f08 21096->21097 21098 7ff784e59f40 21096->21098 21097->21098 21099 7ff784e5fe04 _get_daylight 11 API calls 21097->21099 21098->21067 21098->21072 21100 7ff784e59f36 21099->21100 21101 7ff784e5b464 __free_lconv_num 11 API calls 21100->21101 21101->21098 17018 7ff784e60bfc 17019 7ff784e60dee 17018->17019 17021 7ff784e60c3e _isindst 17018->17021 17070 7ff784e55e48 17019->17070 17021->17019 17024 7ff784e60cbe _isindst 17021->17024 17039 7ff784e67404 17024->17039 17029 7ff784e60e1a 17082 7ff784e5b844 IsProcessorFeaturePresent 17029->17082 17036 7ff784e60d1b 17038 7ff784e60dde 17036->17038 17063 7ff784e67448 17036->17063 17073 7ff784e4bb10 17038->17073 17040 7ff784e67413 17039->17040 17041 7ff784e60cdc 17039->17041 17086 7ff784e61548 EnterCriticalSection 17040->17086 17045 7ff784e66808 17041->17045 17046 7ff784e66811 17045->17046 17047 7ff784e60cf1 17045->17047 17048 7ff784e55e48 _get_daylight 11 API calls 17046->17048 17047->17029 17051 7ff784e66838 17047->17051 17049 7ff784e66816 17048->17049 17087 7ff784e5b824 17049->17087 17052 7ff784e66841 17051->17052 17054 7ff784e60d02 17051->17054 17053 7ff784e55e48 _get_daylight 11 API calls 17052->17053 17055 7ff784e66846 17053->17055 17054->17029 17057 7ff784e66868 17054->17057 17056 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 17055->17056 17056->17054 17058 7ff784e60d13 17057->17058 17059 7ff784e66871 17057->17059 17058->17029 17058->17036 17060 7ff784e55e48 _get_daylight 11 API calls 17059->17060 17061 7ff784e66876 17060->17061 17062 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 17061->17062 17062->17058 17171 7ff784e61548 EnterCriticalSection 17063->17171 17172 7ff784e5c1c8 GetLastError 17070->17172 17072 7ff784e55e51 17072->17038 17074 7ff784e4bb19 17073->17074 17075 7ff784e4bb24 17074->17075 17076 7ff784e4bea0 IsProcessorFeaturePresent 17074->17076 17077 7ff784e4beb8 17076->17077 17189 7ff784e4c098 RtlCaptureContext 17077->17189 17083 7ff784e5b857 17082->17083 17194 7ff784e5b558 17083->17194 17090 7ff784e5b6bc 17087->17090 17089 7ff784e5b83d 17089->17047 17091 7ff784e5b6e7 17090->17091 17094 7ff784e5b758 17091->17094 17093 7ff784e5b70e 17093->17089 17104 7ff784e5b4a0 17094->17104 17099 7ff784e5b793 17099->17093 17100 7ff784e5b844 _isindst 17 API calls 17101 7ff784e5b823 17100->17101 17102 7ff784e5b6bc _invalid_parameter_noinfo 37 API calls 17101->17102 17103 7ff784e5b83d 17102->17103 17103->17093 17105 7ff784e5b4bc GetLastError 17104->17105 17106 7ff784e5b4f7 17104->17106 17107 7ff784e5b4cc 17105->17107 17106->17099 17110 7ff784e5b50c 17106->17110 17113 7ff784e5c290 17107->17113 17111 7ff784e5b528 GetLastError SetLastError 17110->17111 17112 7ff784e5b540 17110->17112 17111->17112 17112->17099 17112->17100 17114 7ff784e5c2ca FlsSetValue 17113->17114 17115 7ff784e5c2af FlsGetValue 17113->17115 17116 7ff784e5b4e7 SetLastError 17114->17116 17118 7ff784e5c2d7 17114->17118 17115->17116 17117 7ff784e5c2c4 17115->17117 17116->17106 17117->17114 17130 7ff784e5fe04 17118->17130 17121 7ff784e5c304 FlsSetValue 17123 7ff784e5c310 FlsSetValue 17121->17123 17124 7ff784e5c322 17121->17124 17122 7ff784e5c2f4 FlsSetValue 17125 7ff784e5c2fd 17122->17125 17123->17125 17143 7ff784e5bdfc 17124->17143 17137 7ff784e5b464 17125->17137 17135 7ff784e5fe15 _get_daylight 17130->17135 17131 7ff784e5fe66 17134 7ff784e55e48 _get_daylight 10 API calls 17131->17134 17132 7ff784e5fe4a HeapAlloc 17133 7ff784e5c2e6 17132->17133 17132->17135 17133->17121 17133->17122 17134->17133 17135->17131 17135->17132 17148 7ff784e64800 17135->17148 17138 7ff784e5b469 RtlFreeHeap 17137->17138 17142 7ff784e5b498 17137->17142 17139 7ff784e5b484 GetLastError 17138->17139 17138->17142 17140 7ff784e5b491 __free_lconv_num 17139->17140 17141 7ff784e55e48 _get_daylight 9 API calls 17140->17141 17141->17142 17142->17116 17157 7ff784e5bcd4 17143->17157 17151 7ff784e64840 17148->17151 17156 7ff784e61548 EnterCriticalSection 17151->17156 17169 7ff784e61548 EnterCriticalSection 17157->17169 17173 7ff784e5c209 FlsSetValue 17172->17173 17177 7ff784e5c1ec 17172->17177 17174 7ff784e5c21b 17173->17174 17186 7ff784e5c1f9 17173->17186 17176 7ff784e5fe04 _get_daylight 5 API calls 17174->17176 17175 7ff784e5c275 SetLastError 17175->17072 17178 7ff784e5c22a 17176->17178 17177->17173 17177->17186 17179 7ff784e5c248 FlsSetValue 17178->17179 17180 7ff784e5c238 FlsSetValue 17178->17180 17182 7ff784e5c254 FlsSetValue 17179->17182 17183 7ff784e5c266 17179->17183 17181 7ff784e5c241 17180->17181 17184 7ff784e5b464 __free_lconv_num 5 API calls 17181->17184 17182->17181 17185 7ff784e5bdfc _get_daylight 5 API calls 17183->17185 17184->17186 17187 7ff784e5c26e 17185->17187 17186->17175 17188 7ff784e5b464 __free_lconv_num 5 API calls 17187->17188 17188->17175 17190 7ff784e4c0b2 RtlLookupFunctionEntry 17189->17190 17191 7ff784e4c0c8 RtlVirtualUnwind 17190->17191 17192 7ff784e4becb 17190->17192 17191->17190 17191->17192 17193 7ff784e4be60 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17192->17193 17195 7ff784e5b592 __CxxCallCatchBlock memcpy_s 17194->17195 17196 7ff784e5b5ba RtlCaptureContext RtlLookupFunctionEntry 17195->17196 17197 7ff784e5b62a IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17196->17197 17198 7ff784e5b5f4 RtlVirtualUnwind 17196->17198 17199 7ff784e5b67c __CxxCallCatchBlock 17197->17199 17198->17197 17200 7ff784e4bb10 _log10_special 8 API calls 17199->17200 17201 7ff784e5b69b GetCurrentProcess TerminateProcess 17200->17201 17202 7ff784e4c1fc 17223 7ff784e4c3dc 17202->17223 17205 7ff784e4c21d __scrt_acquire_startup_lock 17208 7ff784e4c35d 17205->17208 17214 7ff784e4c23b __scrt_release_startup_lock 17205->17214 17206 7ff784e4c353 17390 7ff784e4c6fc IsProcessorFeaturePresent 17206->17390 17209 7ff784e4c6fc 7 API calls 17208->17209 17211 7ff784e4c368 __CxxCallCatchBlock 17209->17211 17210 7ff784e4c260 17212 7ff784e4c2e6 17231 7ff784e5a6b8 17212->17231 17214->17210 17214->17212 17379 7ff784e5aa64 17214->17379 17216 7ff784e4c2eb 17237 7ff784e41000 17216->17237 17220 7ff784e4c30f 17220->17211 17386 7ff784e4c560 17220->17386 17224 7ff784e4c3e4 17223->17224 17225 7ff784e4c3f0 __scrt_dllmain_crt_thread_attach 17224->17225 17226 7ff784e4c3fd 17225->17226 17227 7ff784e4c215 17225->17227 17397 7ff784e5b30c 17226->17397 17227->17205 17227->17206 17232 7ff784e5a6c8 17231->17232 17236 7ff784e5a6dd 17231->17236 17232->17236 17440 7ff784e5a148 17232->17440 17236->17216 17238 7ff784e42b80 17237->17238 17509 7ff784e563c0 17238->17509 17240 7ff784e42bbc 17516 7ff784e42a70 17240->17516 17244 7ff784e4bb10 _log10_special 8 API calls 17246 7ff784e430ec 17244->17246 17384 7ff784e4c84c GetModuleHandleW 17246->17384 17247 7ff784e42bfd 17683 7ff784e41c60 17247->17683 17248 7ff784e42cdb 17692 7ff784e439d0 17248->17692 17251 7ff784e42c1c 17588 7ff784e47e70 17251->17588 17254 7ff784e42d2a 17715 7ff784e41e50 17254->17715 17255 7ff784e42c4f 17265 7ff784e42c7b __std_exception_copy 17255->17265 17687 7ff784e47fe0 17255->17687 17258 7ff784e42d1d 17259 7ff784e42d22 17258->17259 17260 7ff784e42d45 17258->17260 17711 7ff784e4f5a4 17259->17711 17261 7ff784e41c60 49 API calls 17260->17261 17264 7ff784e42d64 17261->17264 17269 7ff784e41930 115 API calls 17264->17269 17266 7ff784e47e70 14 API calls 17265->17266 17273 7ff784e42c9e __std_exception_copy 17265->17273 17266->17273 17267 7ff784e47f80 40 API calls 17268 7ff784e42dcc 17267->17268 17270 7ff784e47fe0 40 API calls 17268->17270 17272 7ff784e42d8e 17269->17272 17271 7ff784e42dd8 17270->17271 17274 7ff784e47fe0 40 API calls 17271->17274 17272->17251 17275 7ff784e42d9e 17272->17275 17273->17267 17279 7ff784e42cce __std_exception_copy 17273->17279 17276 7ff784e42de4 17274->17276 17277 7ff784e41e50 81 API calls 17275->17277 17278 7ff784e47fe0 40 API calls 17276->17278 17285 7ff784e42bc9 __std_exception_copy 17277->17285 17278->17279 17280 7ff784e47e70 14 API calls 17279->17280 17281 7ff784e42e04 17280->17281 17282 7ff784e42ef9 17281->17282 17283 7ff784e42e29 __std_exception_copy 17281->17283 17284 7ff784e41e50 81 API calls 17282->17284 17298 7ff784e42e6c 17283->17298 17601 7ff784e47f80 17283->17601 17284->17285 17285->17244 17287 7ff784e4303a 17291 7ff784e47e70 14 API calls 17287->17291 17288 7ff784e43033 17726 7ff784e485b0 17288->17726 17292 7ff784e4304f __std_exception_copy 17291->17292 17293 7ff784e4308a 17292->17293 17294 7ff784e43187 17292->17294 17295 7ff784e4311a 17293->17295 17296 7ff784e43094 17293->17296 17733 7ff784e438f0 17294->17733 17300 7ff784e47e70 14 API calls 17295->17300 17608 7ff784e485c0 17296->17608 17298->17287 17298->17288 17303 7ff784e43126 17300->17303 17301 7ff784e43195 17304 7ff784e431b7 17301->17304 17305 7ff784e431ab 17301->17305 17306 7ff784e430a5 17303->17306 17309 7ff784e43133 17303->17309 17308 7ff784e41c60 49 API calls 17304->17308 17736 7ff784e43a40 17305->17736 17312 7ff784e41e50 81 API calls 17306->17312 17319 7ff784e4310e __std_exception_copy 17308->17319 17313 7ff784e41c60 49 API calls 17309->17313 17312->17285 17316 7ff784e43151 17313->17316 17314 7ff784e4320a 17658 7ff784e48950 17314->17658 17318 7ff784e43158 17316->17318 17316->17319 17317 7ff784e4321d SetDllDirectoryW 17323 7ff784e43250 17317->17323 17369 7ff784e432a1 17317->17369 17322 7ff784e41e50 81 API calls 17318->17322 17319->17314 17320 7ff784e431ed SetDllDirectoryW LoadLibraryExW 17319->17320 17320->17314 17322->17285 17325 7ff784e47e70 14 API calls 17323->17325 17324 7ff784e43433 17327 7ff784e4343e 17324->17327 17333 7ff784e43445 17324->17333 17332 7ff784e4325c __std_exception_copy 17325->17332 17326 7ff784e43362 17663 7ff784e42780 17326->17663 17329 7ff784e485b0 5 API calls 17327->17329 17331 7ff784e43443 17329->17331 17331->17333 17336 7ff784e43339 17332->17336 17340 7ff784e43295 17332->17340 17813 7ff784e42720 17333->17813 17339 7ff784e47f80 40 API calls 17336->17339 17339->17369 17340->17369 17739 7ff784e46200 17340->17739 17369->17324 17369->17326 17380 7ff784e5aa9c 17379->17380 17381 7ff784e5aa7b 17379->17381 19989 7ff784e5b358 17380->19989 17381->17212 17385 7ff784e4c85d 17384->17385 17385->17220 17387 7ff784e4c571 17386->17387 17388 7ff784e4c326 17387->17388 17389 7ff784e4ce18 7 API calls 17387->17389 17388->17210 17389->17388 17391 7ff784e4c722 __CxxCallCatchBlock memcpy_s 17390->17391 17392 7ff784e4c741 RtlCaptureContext RtlLookupFunctionEntry 17391->17392 17393 7ff784e4c76a RtlVirtualUnwind 17392->17393 17394 7ff784e4c7a6 memcpy_s 17392->17394 17393->17394 17395 7ff784e4c7d8 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 17394->17395 17396 7ff784e4c826 __CxxCallCatchBlock 17395->17396 17396->17208 17398 7ff784e6471c 17397->17398 17399 7ff784e4c402 17398->17399 17407 7ff784e5d420 17398->17407 17399->17227 17401 7ff784e4ce18 17399->17401 17402 7ff784e4ce2a 17401->17402 17403 7ff784e4ce20 17401->17403 17402->17227 17419 7ff784e4d1b4 17403->17419 17418 7ff784e61548 EnterCriticalSection 17407->17418 17420 7ff784e4d1c3 17419->17420 17422 7ff784e4ce25 17419->17422 17427 7ff784e4d3f0 17420->17427 17423 7ff784e4d220 17422->17423 17424 7ff784e4d24b 17423->17424 17425 7ff784e4d22e DeleteCriticalSection 17424->17425 17426 7ff784e4d24f 17424->17426 17425->17424 17426->17402 17431 7ff784e4d258 17427->17431 17432 7ff784e4d342 TlsFree 17431->17432 17437 7ff784e4d29c __vcrt_FlsAlloc 17431->17437 17433 7ff784e4d2ca LoadLibraryExW 17435 7ff784e4d2eb GetLastError 17433->17435 17436 7ff784e4d369 17433->17436 17434 7ff784e4d389 GetProcAddress 17434->17432 17435->17437 17436->17434 17438 7ff784e4d380 FreeLibrary 17436->17438 17437->17432 17437->17433 17437->17434 17439 7ff784e4d30d LoadLibraryExW 17437->17439 17438->17434 17439->17436 17439->17437 17441 7ff784e5a161 17440->17441 17449 7ff784e5a15d 17440->17449 17461 7ff784e63cac GetEnvironmentStringsW 17441->17461 17444 7ff784e5a16e 17446 7ff784e5b464 __free_lconv_num 11 API calls 17444->17446 17445 7ff784e5a17a 17468 7ff784e5a2c8 17445->17468 17446->17449 17449->17236 17453 7ff784e5a508 17449->17453 17450 7ff784e5b464 __free_lconv_num 11 API calls 17451 7ff784e5a1a1 17450->17451 17452 7ff784e5b464 __free_lconv_num 11 API calls 17451->17452 17452->17449 17454 7ff784e5a52b 17453->17454 17459 7ff784e5a542 17453->17459 17454->17236 17455 7ff784e5fe04 _get_daylight 11 API calls 17455->17459 17456 7ff784e5a5b6 17458 7ff784e5b464 __free_lconv_num 11 API calls 17456->17458 17457 7ff784e60b10 MultiByteToWideChar _fread_nolock 17457->17459 17458->17454 17459->17454 17459->17455 17459->17456 17459->17457 17460 7ff784e5b464 __free_lconv_num 11 API calls 17459->17460 17460->17459 17462 7ff784e5a166 17461->17462 17463 7ff784e63cd0 17461->17463 17462->17444 17462->17445 17487 7ff784e5e6c4 17463->17487 17465 7ff784e63d07 memcpy_s 17466 7ff784e5b464 __free_lconv_num 11 API calls 17465->17466 17467 7ff784e63d27 FreeEnvironmentStringsW 17466->17467 17467->17462 17469 7ff784e5a2f0 17468->17469 17470 7ff784e5fe04 _get_daylight 11 API calls 17469->17470 17471 7ff784e5a32b 17470->17471 17473 7ff784e5a3ad 17471->17473 17476 7ff784e5fe04 _get_daylight 11 API calls 17471->17476 17477 7ff784e5a39c 17471->17477 17482 7ff784e5a3d0 17471->17482 17483 7ff784e5a333 17471->17483 17485 7ff784e5b464 __free_lconv_num 11 API calls 17471->17485 17494 7ff784e616e4 17471->17494 17472 7ff784e5b464 __free_lconv_num 11 API calls 17475 7ff784e5a182 17472->17475 17474 7ff784e5b464 __free_lconv_num 11 API calls 17473->17474 17474->17475 17475->17450 17476->17471 17503 7ff784e5a3e4 17477->17503 17481 7ff784e5b464 __free_lconv_num 11 API calls 17481->17483 17484 7ff784e5b844 _isindst 17 API calls 17482->17484 17483->17472 17486 7ff784e5a3e2 17484->17486 17485->17471 17488 7ff784e5e70f 17487->17488 17492 7ff784e5e6d3 _get_daylight 17487->17492 17490 7ff784e55e48 _get_daylight 11 API calls 17488->17490 17489 7ff784e5e6f6 HeapAlloc 17491 7ff784e5e70d 17489->17491 17489->17492 17490->17491 17491->17465 17492->17488 17492->17489 17493 7ff784e64800 _get_daylight 2 API calls 17492->17493 17493->17492 17495 7ff784e616fb 17494->17495 17496 7ff784e616f1 17494->17496 17497 7ff784e55e48 _get_daylight 11 API calls 17495->17497 17496->17495 17501 7ff784e61717 17496->17501 17498 7ff784e61703 17497->17498 17499 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 17498->17499 17500 7ff784e6170f 17499->17500 17500->17471 17501->17500 17502 7ff784e55e48 _get_daylight 11 API calls 17501->17502 17502->17498 17504 7ff784e5a3e9 17503->17504 17505 7ff784e5a3a4 17503->17505 17506 7ff784e5a412 17504->17506 17507 7ff784e5b464 __free_lconv_num 11 API calls 17504->17507 17505->17481 17508 7ff784e5b464 __free_lconv_num 11 API calls 17506->17508 17507->17504 17508->17505 17512 7ff784e606f0 17509->17512 17510 7ff784e60743 17511 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 17510->17511 17515 7ff784e6076c 17511->17515 17512->17510 17513 7ff784e60796 17512->17513 17826 7ff784e605c8 17513->17826 17515->17240 17834 7ff784e4be10 17516->17834 17519 7ff784e42aab GetLastError 17841 7ff784e42310 17519->17841 17520 7ff784e42ad0 17836 7ff784e48840 FindFirstFileExW 17520->17836 17524 7ff784e42ac6 17527 7ff784e4bb10 _log10_special 8 API calls 17524->17527 17525 7ff784e42b3d 17871 7ff784e48a00 17525->17871 17526 7ff784e42ae3 17858 7ff784e488c0 CreateFileW 17526->17858 17530 7ff784e42b75 17527->17530 17530->17285 17538 7ff784e41930 17530->17538 17532 7ff784e42b4b 17532->17524 17535 7ff784e41f30 78 API calls 17532->17535 17533 7ff784e42b0c __vcrt_FlsAlloc 17533->17525 17534 7ff784e42af4 17861 7ff784e41f30 17534->17861 17535->17524 17539 7ff784e439d0 108 API calls 17538->17539 17540 7ff784e41965 17539->17540 17541 7ff784e41c23 17540->17541 17543 7ff784e473d0 83 API calls 17540->17543 17542 7ff784e4bb10 _log10_special 8 API calls 17541->17542 17544 7ff784e41c3e 17542->17544 17545 7ff784e419ab 17543->17545 17544->17247 17544->17248 17587 7ff784e419e3 17545->17587 18285 7ff784e4fc2c 17545->18285 17547 7ff784e4f5a4 74 API calls 17547->17541 17548 7ff784e419c5 17549 7ff784e419c9 17548->17549 17550 7ff784e419e8 17548->17550 17552 7ff784e55e48 _get_daylight 11 API calls 17549->17552 18289 7ff784e4f8f4 17550->18289 17553 7ff784e419ce 17552->17553 18292 7ff784e42020 17553->18292 17556 7ff784e41a06 17558 7ff784e55e48 _get_daylight 11 API calls 17556->17558 17557 7ff784e41a25 17561 7ff784e41a3c 17557->17561 17562 7ff784e41a5b 17557->17562 17559 7ff784e41a0b 17558->17559 17560 7ff784e42020 87 API calls 17559->17560 17560->17587 17564 7ff784e55e48 _get_daylight 11 API calls 17561->17564 17563 7ff784e41c60 49 API calls 17562->17563 17566 7ff784e41a72 17563->17566 17565 7ff784e41a41 17564->17565 17567 7ff784e42020 87 API calls 17565->17567 17568 7ff784e41c60 49 API calls 17566->17568 17567->17587 17569 7ff784e41abd 17568->17569 17570 7ff784e4fc2c 73 API calls 17569->17570 17571 7ff784e41ae1 17570->17571 17572 7ff784e41af6 17571->17572 17573 7ff784e41b15 17571->17573 17575 7ff784e55e48 _get_daylight 11 API calls 17572->17575 17574 7ff784e4f8f4 _fread_nolock 53 API calls 17573->17574 17576 7ff784e41b2a 17574->17576 17577 7ff784e41afb 17575->17577 17578 7ff784e41b30 17576->17578 17579 7ff784e41b4f 17576->17579 17580 7ff784e42020 87 API calls 17577->17580 17581 7ff784e55e48 _get_daylight 11 API calls 17578->17581 18307 7ff784e4f668 17579->18307 17580->17587 17583 7ff784e41b35 17581->17583 17585 7ff784e42020 87 API calls 17583->17585 17585->17587 17586 7ff784e41e50 81 API calls 17586->17587 17587->17547 17589 7ff784e47e7a 17588->17589 17590 7ff784e48950 2 API calls 17589->17590 17591 7ff784e47e99 GetEnvironmentVariableW 17590->17591 17592 7ff784e47f02 17591->17592 17593 7ff784e47eb6 ExpandEnvironmentStringsW 17591->17593 17594 7ff784e4bb10 _log10_special 8 API calls 17592->17594 17593->17592 17595 7ff784e47ed8 17593->17595 17596 7ff784e47f14 17594->17596 17597 7ff784e48a00 2 API calls 17595->17597 17596->17255 17598 7ff784e47eea 17597->17598 17599 7ff784e4bb10 _log10_special 8 API calls 17598->17599 17600 7ff784e47efa 17599->17600 17600->17255 17602 7ff784e48950 2 API calls 17601->17602 17603 7ff784e47f9c 17602->17603 17604 7ff784e48950 2 API calls 17603->17604 17605 7ff784e47fac 17604->17605 18571 7ff784e59174 17605->18571 17607 7ff784e47fba __std_exception_copy 17607->17298 17609 7ff784e485d5 17608->17609 18589 7ff784e47bb0 GetCurrentProcess OpenProcessToken 17609->18589 17612 7ff784e47bb0 7 API calls 17613 7ff784e48601 17612->17613 17614 7ff784e4861a 17613->17614 17615 7ff784e48634 17613->17615 17616 7ff784e41d50 48 API calls 17614->17616 17617 7ff784e41d50 48 API calls 17615->17617 17618 7ff784e48632 17616->17618 17619 7ff784e48647 LocalFree LocalFree 17617->17619 17618->17619 17620 7ff784e48663 17619->17620 17622 7ff784e4866f 17619->17622 18599 7ff784e42220 17620->18599 17623 7ff784e4bb10 _log10_special 8 API calls 17622->17623 17624 7ff784e43099 17623->17624 17624->17306 17625 7ff784e47ca0 17624->17625 17626 7ff784e47cb8 17625->17626 17627 7ff784e47d3a GetTempPathW GetCurrentProcessId 17626->17627 17628 7ff784e47cdc 17626->17628 18610 7ff784e48760 17627->18610 17630 7ff784e47e70 14 API calls 17628->17630 17631 7ff784e47ce8 17630->17631 18617 7ff784e47610 17631->18617 17637 7ff784e47d68 __std_exception_copy 17644 7ff784e47da5 __std_exception_copy 17637->17644 18614 7ff784e59aa4 17637->18614 17659 7ff784e48972 MultiByteToWideChar 17658->17659 17662 7ff784e48996 17658->17662 17661 7ff784e489ac __std_exception_copy 17659->17661 17659->17662 17660 7ff784e489b3 MultiByteToWideChar 17660->17661 17661->17317 17662->17660 17662->17661 17675 7ff784e4278e memcpy_s 17663->17675 17664 7ff784e4bb10 _log10_special 8 API calls 17665 7ff784e42a24 17664->17665 17665->17285 17682 7ff784e48590 LocalFree 17665->17682 17666 7ff784e42987 17666->17664 17668 7ff784e41c60 49 API calls 17668->17675 17669 7ff784e429a2 17671 7ff784e41e50 81 API calls 17669->17671 17671->17666 17674 7ff784e42989 17677 7ff784e41e50 81 API calls 17674->17677 17675->17666 17675->17668 17675->17669 17675->17674 17676 7ff784e42140 81 API calls 17675->17676 17680 7ff784e42990 17675->17680 18881 7ff784e43970 17675->18881 18887 7ff784e47260 17675->18887 18898 7ff784e415e0 17675->18898 18946 7ff784e46560 17675->18946 18950 7ff784e435a0 17675->18950 18994 7ff784e43860 17675->18994 17676->17675 17677->17666 17681 7ff784e41e50 81 API calls 17680->17681 17681->17666 17684 7ff784e41c85 17683->17684 17685 7ff784e558c4 49 API calls 17684->17685 17686 7ff784e41ca8 17685->17686 17686->17251 17688 7ff784e48950 2 API calls 17687->17688 17689 7ff784e47ff4 17688->17689 17690 7ff784e59174 38 API calls 17689->17690 17691 7ff784e48006 __std_exception_copy 17690->17691 17691->17265 17693 7ff784e439dc 17692->17693 17694 7ff784e48950 2 API calls 17693->17694 17695 7ff784e43a04 17694->17695 17696 7ff784e48950 2 API calls 17695->17696 17697 7ff784e43a17 17696->17697 19177 7ff784e56f54 17697->19177 17700 7ff784e4bb10 _log10_special 8 API calls 17701 7ff784e42ceb 17700->17701 17701->17254 17702 7ff784e473d0 17701->17702 17703 7ff784e473f4 17702->17703 17704 7ff784e4fc2c 73 API calls 17703->17704 17709 7ff784e474cb __std_exception_copy 17703->17709 17705 7ff784e47410 17704->17705 17705->17709 19568 7ff784e58804 17705->19568 17707 7ff784e4fc2c 73 API calls 17710 7ff784e47425 17707->17710 17708 7ff784e4f8f4 _fread_nolock 53 API calls 17708->17710 17709->17258 17710->17707 17710->17708 17710->17709 17712 7ff784e4f5d4 17711->17712 19583 7ff784e4f380 17712->19583 17714 7ff784e4f5ed 17714->17254 17716 7ff784e4be10 17715->17716 17717 7ff784e41e74 GetCurrentProcessId 17716->17717 17718 7ff784e41c60 49 API calls 17717->17718 17719 7ff784e41ec5 17718->17719 17720 7ff784e558c4 49 API calls 17719->17720 17721 7ff784e41f02 17720->17721 17722 7ff784e41cc0 80 API calls 17721->17722 17723 7ff784e41f0c 17722->17723 17724 7ff784e4bb10 _log10_special 8 API calls 17723->17724 17725 7ff784e41f1c 17724->17725 17725->17285 17727 7ff784e48510 GetConsoleWindow 17726->17727 17728 7ff784e43038 17727->17728 17729 7ff784e4852a GetCurrentProcessId GetWindowThreadProcessId 17727->17729 17728->17287 17729->17728 17730 7ff784e48549 17729->17730 17730->17728 17731 7ff784e48551 ShowWindow 17730->17731 17731->17728 17732 7ff784e48560 Sleep 17731->17732 17732->17728 17732->17731 17734 7ff784e41c60 49 API calls 17733->17734 17735 7ff784e4390d 17734->17735 17735->17301 17737 7ff784e41c60 49 API calls 17736->17737 17738 7ff784e43a70 17737->17738 17738->17319 17740 7ff784e46215 17739->17740 17741 7ff784e55e48 _get_daylight 11 API calls 17740->17741 17744 7ff784e432b3 17740->17744 17742 7ff784e46222 17741->17742 17743 7ff784e42020 87 API calls 17742->17743 17743->17744 17745 7ff784e46780 17744->17745 19594 7ff784e41450 17745->19594 19700 7ff784e457a0 17813->19700 17833 7ff784e562dc EnterCriticalSection 17826->17833 17835 7ff784e42a7c GetModuleFileNameW 17834->17835 17835->17519 17835->17520 17837 7ff784e4887f FindClose 17836->17837 17838 7ff784e48892 17836->17838 17837->17838 17839 7ff784e4bb10 _log10_special 8 API calls 17838->17839 17840 7ff784e42ada 17839->17840 17840->17525 17840->17526 17842 7ff784e4be10 17841->17842 17843 7ff784e42330 GetCurrentProcessId 17842->17843 17876 7ff784e41d50 17843->17876 17845 7ff784e4237b 17880 7ff784e55b18 17845->17880 17848 7ff784e41d50 48 API calls 17849 7ff784e423eb FormatMessageW 17848->17849 17851 7ff784e42436 17849->17851 17852 7ff784e42424 17849->17852 17898 7ff784e41e00 17851->17898 17853 7ff784e41d50 48 API calls 17852->17853 17853->17851 17856 7ff784e4bb10 _log10_special 8 API calls 17857 7ff784e42464 17856->17857 17857->17524 17859 7ff784e42af0 17858->17859 17860 7ff784e48900 GetFinalPathNameByHandleW CloseHandle 17858->17860 17859->17533 17859->17534 17860->17859 17862 7ff784e41f54 17861->17862 17863 7ff784e41d50 48 API calls 17862->17863 17864 7ff784e41fa5 17863->17864 17865 7ff784e55b18 48 API calls 17864->17865 17866 7ff784e41fe3 17865->17866 17867 7ff784e41e00 78 API calls 17866->17867 17868 7ff784e42001 17867->17868 17869 7ff784e4bb10 _log10_special 8 API calls 17868->17869 17870 7ff784e42011 17869->17870 17870->17524 17872 7ff784e48a2a WideCharToMultiByte 17871->17872 17874 7ff784e48a55 17871->17874 17873 7ff784e48a6b __std_exception_copy 17872->17873 17872->17874 17873->17532 17874->17873 17875 7ff784e48a72 WideCharToMultiByte 17874->17875 17875->17873 17877 7ff784e41d75 17876->17877 17878 7ff784e55b18 48 API calls 17877->17878 17879 7ff784e41d98 17878->17879 17879->17845 17883 7ff784e55b72 17880->17883 17881 7ff784e55b97 17882 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 17881->17882 17897 7ff784e55bc1 17882->17897 17883->17881 17884 7ff784e55bd3 17883->17884 17902 7ff784e52e08 17884->17902 17887 7ff784e4bb10 _log10_special 8 API calls 17889 7ff784e423bb 17887->17889 17888 7ff784e5b464 __free_lconv_num 11 API calls 17888->17897 17889->17848 17890 7ff784e55cb4 17890->17888 17891 7ff784e55c89 17894 7ff784e5b464 __free_lconv_num 11 API calls 17891->17894 17892 7ff784e55cda 17892->17890 17893 7ff784e55ce4 17892->17893 17896 7ff784e5b464 __free_lconv_num 11 API calls 17893->17896 17894->17897 17895 7ff784e55c80 17895->17890 17895->17891 17896->17897 17897->17887 17899 7ff784e41e26 17898->17899 18270 7ff784e557a0 17899->18270 17901 7ff784e41e3c 17901->17856 17903 7ff784e52e46 17902->17903 17904 7ff784e52e36 17902->17904 17905 7ff784e52e4f 17903->17905 17910 7ff784e52e7d 17903->17910 17906 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 17904->17906 17907 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 17905->17907 17908 7ff784e52e75 17906->17908 17907->17908 17908->17890 17908->17891 17908->17892 17908->17895 17910->17904 17910->17908 17913 7ff784e54450 17910->17913 17946 7ff784e535a0 17910->17946 17983 7ff784e52390 17910->17983 17914 7ff784e54503 17913->17914 17915 7ff784e54492 17913->17915 17918 7ff784e5455c 17914->17918 17919 7ff784e54508 17914->17919 17916 7ff784e5452d 17915->17916 17917 7ff784e54498 17915->17917 18006 7ff784e5132c 17916->18006 17920 7ff784e544cc 17917->17920 17921 7ff784e5449d 17917->17921 17925 7ff784e54573 17918->17925 17927 7ff784e54566 17918->17927 17932 7ff784e5456b 17918->17932 17922 7ff784e5453d 17919->17922 17923 7ff784e5450a 17919->17923 17928 7ff784e544a3 17920->17928 17920->17932 17921->17925 17921->17928 18013 7ff784e50f1c 17922->18013 17926 7ff784e544ac 17923->17926 17935 7ff784e54519 17923->17935 18020 7ff784e55158 17925->18020 17945 7ff784e5459c 17926->17945 17986 7ff784e54c04 17926->17986 17927->17916 17927->17932 17928->17926 17933 7ff784e544de 17928->17933 17941 7ff784e544c7 17928->17941 17932->17945 18024 7ff784e5173c 17932->18024 17933->17945 17996 7ff784e54f40 17933->17996 17935->17916 17937 7ff784e5451e 17935->17937 17937->17945 18002 7ff784e55004 17937->18002 17938 7ff784e4bb10 _log10_special 8 API calls 17939 7ff784e54896 17938->17939 17939->17910 17944 7ff784e54788 17941->17944 17941->17945 18031 7ff784e55270 17941->18031 17944->17945 18037 7ff784e5fad0 17944->18037 17945->17938 17947 7ff784e535ae 17946->17947 17948 7ff784e535c4 17946->17948 17949 7ff784e53604 17947->17949 17950 7ff784e54503 17947->17950 17951 7ff784e54492 17947->17951 17948->17949 17952 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 17948->17952 17949->17910 17955 7ff784e5455c 17950->17955 17956 7ff784e54508 17950->17956 17953 7ff784e5452d 17951->17953 17954 7ff784e54498 17951->17954 17952->17949 17961 7ff784e5132c 38 API calls 17953->17961 17957 7ff784e544cc 17954->17957 17958 7ff784e5449d 17954->17958 17962 7ff784e54573 17955->17962 17964 7ff784e54566 17955->17964 17968 7ff784e5456b 17955->17968 17959 7ff784e5453d 17956->17959 17960 7ff784e5450a 17956->17960 17965 7ff784e544a3 17957->17965 17957->17968 17958->17962 17958->17965 17966 7ff784e50f1c 38 API calls 17959->17966 17963 7ff784e544ac 17960->17963 17972 7ff784e54519 17960->17972 17978 7ff784e544c7 17961->17978 17969 7ff784e55158 45 API calls 17962->17969 17967 7ff784e54c04 47 API calls 17963->17967 17982 7ff784e5459c 17963->17982 17964->17953 17964->17968 17965->17963 17970 7ff784e544de 17965->17970 17965->17978 17966->17978 17967->17978 17971 7ff784e5173c 38 API calls 17968->17971 17968->17982 17969->17978 17973 7ff784e54f40 46 API calls 17970->17973 17970->17982 17971->17978 17972->17953 17974 7ff784e5451e 17972->17974 17973->17978 17977 7ff784e55004 37 API calls 17974->17977 17974->17982 17975 7ff784e4bb10 _log10_special 8 API calls 17976 7ff784e54896 17975->17976 17976->17910 17977->17978 17979 7ff784e55270 45 API calls 17978->17979 17981 7ff784e54788 17978->17981 17978->17982 17979->17981 17980 7ff784e5fad0 46 API calls 17980->17981 17981->17980 17981->17982 17982->17975 18253 7ff784e505a0 17983->18253 17987 7ff784e54c2a 17986->17987 18049 7ff784e50158 17987->18049 17992 7ff784e55270 45 API calls 17993 7ff784e54d6f 17992->17993 17994 7ff784e55270 45 API calls 17993->17994 17995 7ff784e54dfd 17993->17995 17994->17995 17995->17941 17997 7ff784e54f75 17996->17997 17998 7ff784e54f93 17997->17998 17999 7ff784e55270 45 API calls 17997->17999 18001 7ff784e54fba 17997->18001 18000 7ff784e5fad0 46 API calls 17998->18000 17999->17998 18000->18001 18001->17941 18005 7ff784e55025 18002->18005 18003 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18004 7ff784e55056 18003->18004 18004->17941 18005->18003 18005->18004 18007 7ff784e5135f 18006->18007 18008 7ff784e5138e 18007->18008 18010 7ff784e5144b 18007->18010 18012 7ff784e513cb 18008->18012 18185 7ff784e50200 18008->18185 18011 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18010->18011 18011->18012 18012->17941 18015 7ff784e50f4f 18013->18015 18014 7ff784e50f7e 18016 7ff784e50200 12 API calls 18014->18016 18019 7ff784e50fbb 18014->18019 18015->18014 18017 7ff784e5103b 18015->18017 18016->18019 18018 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18017->18018 18018->18019 18019->17941 18021 7ff784e5519b 18020->18021 18023 7ff784e5519f __crtLCMapStringW 18021->18023 18193 7ff784e551f4 18021->18193 18023->17941 18025 7ff784e5176f 18024->18025 18026 7ff784e5179e 18025->18026 18028 7ff784e5185b 18025->18028 18027 7ff784e50200 12 API calls 18026->18027 18030 7ff784e517db 18026->18030 18027->18030 18029 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18028->18029 18029->18030 18030->17941 18032 7ff784e55287 18031->18032 18197 7ff784e5ea80 18032->18197 18038 7ff784e5fb01 18037->18038 18047 7ff784e5fb0f 18037->18047 18039 7ff784e5fb2f 18038->18039 18040 7ff784e55270 45 API calls 18038->18040 18038->18047 18041 7ff784e5fb67 18039->18041 18042 7ff784e5fb40 18039->18042 18040->18039 18044 7ff784e5fbf2 18041->18044 18045 7ff784e5fb91 18041->18045 18041->18047 18243 7ff784e61310 18042->18243 18046 7ff784e60b10 _fread_nolock MultiByteToWideChar 18044->18046 18045->18047 18246 7ff784e60b10 18045->18246 18046->18047 18047->17944 18050 7ff784e5018f 18049->18050 18051 7ff784e5017e 18049->18051 18050->18051 18052 7ff784e5e6c4 _fread_nolock 12 API calls 18050->18052 18057 7ff784e5f638 18051->18057 18053 7ff784e501bc 18052->18053 18054 7ff784e501d0 18053->18054 18055 7ff784e5b464 __free_lconv_num 11 API calls 18053->18055 18056 7ff784e5b464 __free_lconv_num 11 API calls 18054->18056 18055->18054 18056->18051 18058 7ff784e5f688 18057->18058 18059 7ff784e5f655 18057->18059 18058->18059 18062 7ff784e5f6ba 18058->18062 18060 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18059->18060 18061 7ff784e54d4d 18060->18061 18061->17992 18061->17993 18068 7ff784e5f7cd 18062->18068 18070 7ff784e5f702 18062->18070 18063 7ff784e5f8bf 18112 7ff784e5eb24 18063->18112 18065 7ff784e5f885 18105 7ff784e5eebc 18065->18105 18067 7ff784e5f854 18098 7ff784e5f19c 18067->18098 18068->18063 18068->18065 18068->18067 18071 7ff784e5f817 18068->18071 18073 7ff784e5f80d 18068->18073 18070->18061 18079 7ff784e5b3ac 18070->18079 18088 7ff784e5f3cc 18071->18088 18073->18065 18074 7ff784e5f812 18073->18074 18074->18067 18074->18071 18077 7ff784e5b844 _isindst 17 API calls 18078 7ff784e5f91c 18077->18078 18080 7ff784e5b3b9 18079->18080 18081 7ff784e5b3c3 18079->18081 18080->18081 18086 7ff784e5b3de 18080->18086 18082 7ff784e55e48 _get_daylight 11 API calls 18081->18082 18083 7ff784e5b3ca 18082->18083 18084 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18083->18084 18085 7ff784e5b3d6 18084->18085 18085->18061 18085->18077 18086->18085 18087 7ff784e55e48 _get_daylight 11 API calls 18086->18087 18087->18083 18121 7ff784e6531c 18088->18121 18092 7ff784e5f474 18093 7ff784e5f4c9 18092->18093 18095 7ff784e5f494 18092->18095 18097 7ff784e5f478 18092->18097 18174 7ff784e5efb8 18093->18174 18170 7ff784e5f274 18095->18170 18097->18061 18099 7ff784e6531c 38 API calls 18098->18099 18100 7ff784e5f1e6 18099->18100 18101 7ff784e64d64 37 API calls 18100->18101 18102 7ff784e5f236 18101->18102 18103 7ff784e5f23a 18102->18103 18104 7ff784e5f274 45 API calls 18102->18104 18103->18061 18104->18103 18106 7ff784e6531c 38 API calls 18105->18106 18107 7ff784e5ef07 18106->18107 18108 7ff784e64d64 37 API calls 18107->18108 18109 7ff784e5ef5f 18108->18109 18110 7ff784e5ef63 18109->18110 18111 7ff784e5efb8 45 API calls 18109->18111 18110->18061 18111->18110 18113 7ff784e5eb9c 18112->18113 18114 7ff784e5eb69 18112->18114 18116 7ff784e5ebb4 18113->18116 18118 7ff784e5ec35 18113->18118 18115 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18114->18115 18120 7ff784e5eb95 memcpy_s 18115->18120 18117 7ff784e5eebc 46 API calls 18116->18117 18117->18120 18119 7ff784e55270 45 API calls 18118->18119 18118->18120 18119->18120 18120->18061 18122 7ff784e6536f fegetenv 18121->18122 18123 7ff784e6909c 37 API calls 18122->18123 18126 7ff784e653c2 18123->18126 18124 7ff784e653ef 18129 7ff784e5b3ac __std_exception_copy 37 API calls 18124->18129 18125 7ff784e654b2 18127 7ff784e6909c 37 API calls 18125->18127 18126->18125 18131 7ff784e6548c 18126->18131 18132 7ff784e653dd 18126->18132 18128 7ff784e654dc 18127->18128 18133 7ff784e6909c 37 API calls 18128->18133 18130 7ff784e6546d 18129->18130 18134 7ff784e66594 18130->18134 18140 7ff784e65475 18130->18140 18135 7ff784e5b3ac __std_exception_copy 37 API calls 18131->18135 18132->18124 18132->18125 18136 7ff784e654ed 18133->18136 18137 7ff784e5b844 _isindst 17 API calls 18134->18137 18135->18130 18138 7ff784e69290 20 API calls 18136->18138 18139 7ff784e665a9 18137->18139 18147 7ff784e65556 memcpy_s 18138->18147 18141 7ff784e4bb10 _log10_special 8 API calls 18140->18141 18142 7ff784e5f419 18141->18142 18166 7ff784e64d64 18142->18166 18143 7ff784e658ff memcpy_s 18144 7ff784e65597 memcpy_s 18159 7ff784e659f3 memcpy_s 18144->18159 18165 7ff784e65edb memcpy_s 18144->18165 18145 7ff784e65beb 18145->18145 18148 7ff784e65c3f 18145->18148 18149 7ff784e665ac memcpy_s 37 API calls 18145->18149 18146 7ff784e64e80 37 API calls 18151 7ff784e66357 18146->18151 18147->18143 18147->18144 18150 7ff784e55e48 _get_daylight 11 API calls 18147->18150 18148->18146 18149->18148 18152 7ff784e659d0 18150->18152 18154 7ff784e665ac memcpy_s 37 API calls 18151->18154 18164 7ff784e663b2 18151->18164 18153 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18152->18153 18153->18144 18154->18164 18155 7ff784e66538 18157 7ff784e6909c 37 API calls 18155->18157 18156 7ff784e55e48 11 API calls _get_daylight 18156->18159 18157->18140 18158 7ff784e55e48 11 API calls _get_daylight 18158->18165 18159->18145 18159->18156 18162 7ff784e5b824 37 API calls _invalid_parameter_noinfo 18159->18162 18160 7ff784e64e80 37 API calls 18160->18164 18161 7ff784e5b824 37 API calls _invalid_parameter_noinfo 18161->18165 18162->18159 18163 7ff784e665ac memcpy_s 37 API calls 18163->18164 18164->18155 18164->18160 18164->18163 18165->18145 18165->18148 18165->18158 18165->18161 18167 7ff784e64d83 18166->18167 18168 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18167->18168 18169 7ff784e64dae memcpy_s 18167->18169 18168->18169 18169->18092 18171 7ff784e5f2a0 memcpy_s 18170->18171 18172 7ff784e55270 45 API calls 18171->18172 18173 7ff784e5f35a memcpy_s 18171->18173 18172->18173 18173->18097 18175 7ff784e5eff3 18174->18175 18178 7ff784e5f040 memcpy_s 18174->18178 18176 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18175->18176 18177 7ff784e5f01f 18176->18177 18177->18097 18179 7ff784e5f0ab 18178->18179 18181 7ff784e55270 45 API calls 18178->18181 18180 7ff784e5b3ac __std_exception_copy 37 API calls 18179->18180 18184 7ff784e5f0ed memcpy_s 18180->18184 18181->18179 18182 7ff784e5b844 _isindst 17 API calls 18183 7ff784e5f198 18182->18183 18184->18182 18186 7ff784e50237 18185->18186 18191 7ff784e50226 18185->18191 18187 7ff784e5e6c4 _fread_nolock 12 API calls 18186->18187 18186->18191 18188 7ff784e50268 18187->18188 18189 7ff784e5b464 __free_lconv_num 11 API calls 18188->18189 18192 7ff784e5027c 18188->18192 18189->18192 18190 7ff784e5b464 __free_lconv_num 11 API calls 18190->18191 18191->18012 18192->18190 18194 7ff784e55212 18193->18194 18196 7ff784e5521a 18193->18196 18195 7ff784e55270 45 API calls 18194->18195 18195->18196 18196->18023 18198 7ff784e5ea99 18197->18198 18199 7ff784e552af 18197->18199 18198->18199 18205 7ff784e64574 18198->18205 18201 7ff784e5eaec 18199->18201 18202 7ff784e552bf 18201->18202 18203 7ff784e5eb05 18201->18203 18202->17944 18203->18202 18240 7ff784e638c0 18203->18240 18217 7ff784e5c050 GetLastError 18205->18217 18208 7ff784e645ce 18208->18199 18218 7ff784e5c074 FlsGetValue 18217->18218 18219 7ff784e5c091 FlsSetValue 18217->18219 18220 7ff784e5c081 18218->18220 18222 7ff784e5c08b 18218->18222 18219->18220 18221 7ff784e5c0a3 18219->18221 18223 7ff784e5c0fd SetLastError 18220->18223 18224 7ff784e5fe04 _get_daylight 11 API calls 18221->18224 18222->18219 18225 7ff784e5c11d 18223->18225 18226 7ff784e5c10a 18223->18226 18227 7ff784e5c0b2 18224->18227 18228 7ff784e5b40c __CxxCallCatchBlock 38 API calls 18225->18228 18226->18208 18239 7ff784e61548 EnterCriticalSection 18226->18239 18229 7ff784e5c0d0 FlsSetValue 18227->18229 18230 7ff784e5c0c0 FlsSetValue 18227->18230 18231 7ff784e5c122 18228->18231 18233 7ff784e5c0dc FlsSetValue 18229->18233 18234 7ff784e5c0ee 18229->18234 18232 7ff784e5c0c9 18230->18232 18235 7ff784e5b464 __free_lconv_num 11 API calls 18232->18235 18233->18232 18236 7ff784e5bdfc _get_daylight 11 API calls 18234->18236 18235->18220 18237 7ff784e5c0f6 18236->18237 18238 7ff784e5b464 __free_lconv_num 11 API calls 18237->18238 18238->18223 18241 7ff784e5c050 __CxxCallCatchBlock 45 API calls 18240->18241 18242 7ff784e638c9 18241->18242 18249 7ff784e67ff8 18243->18249 18247 7ff784e60b19 MultiByteToWideChar 18246->18247 18251 7ff784e6805c 18249->18251 18250 7ff784e4bb10 _log10_special 8 API calls 18252 7ff784e6132d 18250->18252 18251->18250 18252->18047 18254 7ff784e505e7 18253->18254 18255 7ff784e505d5 18253->18255 18258 7ff784e505f5 18254->18258 18264 7ff784e50631 18254->18264 18256 7ff784e55e48 _get_daylight 11 API calls 18255->18256 18257 7ff784e505da 18256->18257 18260 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18257->18260 18259 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18258->18259 18267 7ff784e505e5 18259->18267 18260->18267 18261 7ff784e509ad 18262 7ff784e55e48 _get_daylight 11 API calls 18261->18262 18261->18267 18265 7ff784e50c41 18262->18265 18263 7ff784e55e48 _get_daylight 11 API calls 18266 7ff784e509a2 18263->18266 18264->18261 18264->18263 18268 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18265->18268 18269 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18266->18269 18267->17910 18268->18267 18269->18261 18271 7ff784e557ca 18270->18271 18272 7ff784e55802 18271->18272 18273 7ff784e55835 18271->18273 18274 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18272->18274 18277 7ff784e500d8 18273->18277 18276 7ff784e5582b 18274->18276 18276->17901 18284 7ff784e562dc EnterCriticalSection 18277->18284 18286 7ff784e4fc5c 18285->18286 18313 7ff784e4f9bc 18286->18313 18288 7ff784e4fc75 18288->17548 18325 7ff784e4f914 18289->18325 18293 7ff784e4be10 18292->18293 18294 7ff784e42040 GetCurrentProcessId 18293->18294 18295 7ff784e41c60 49 API calls 18294->18295 18296 7ff784e4208b 18295->18296 18339 7ff784e558c4 18296->18339 18300 7ff784e420ec 18301 7ff784e41c60 49 API calls 18300->18301 18302 7ff784e42106 18301->18302 18379 7ff784e41cc0 18302->18379 18305 7ff784e4bb10 _log10_special 8 API calls 18306 7ff784e42120 18305->18306 18306->17587 18308 7ff784e4f671 18307->18308 18312 7ff784e41b69 18307->18312 18309 7ff784e55e48 _get_daylight 11 API calls 18308->18309 18310 7ff784e4f676 18309->18310 18311 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18310->18311 18311->18312 18312->17586 18312->17587 18314 7ff784e4fa26 18313->18314 18315 7ff784e4f9e6 18313->18315 18314->18315 18317 7ff784e4fa32 18314->18317 18316 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18315->18316 18323 7ff784e4fa0d 18316->18323 18324 7ff784e562dc EnterCriticalSection 18317->18324 18323->18288 18326 7ff784e41a00 18325->18326 18327 7ff784e4f93e 18325->18327 18326->17556 18326->17557 18327->18326 18328 7ff784e4f94d memcpy_s 18327->18328 18329 7ff784e4f98a 18327->18329 18332 7ff784e55e48 _get_daylight 11 API calls 18328->18332 18338 7ff784e562dc EnterCriticalSection 18329->18338 18334 7ff784e4f962 18332->18334 18336 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18334->18336 18336->18326 18341 7ff784e5591e 18339->18341 18340 7ff784e55943 18342 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18340->18342 18341->18340 18343 7ff784e5597f 18341->18343 18356 7ff784e5596d 18342->18356 18390 7ff784e527b8 18343->18390 18346 7ff784e4bb10 _log10_special 8 API calls 18348 7ff784e420ca 18346->18348 18347 7ff784e5b464 __free_lconv_num 11 API calls 18347->18356 18357 7ff784e560a0 18348->18357 18349 7ff784e55a5c 18349->18347 18350 7ff784e55a80 18350->18349 18352 7ff784e55a8a 18350->18352 18351 7ff784e55a31 18353 7ff784e5b464 __free_lconv_num 11 API calls 18351->18353 18355 7ff784e5b464 __free_lconv_num 11 API calls 18352->18355 18353->18356 18354 7ff784e55a28 18354->18349 18354->18351 18355->18356 18356->18346 18358 7ff784e5c1c8 _get_daylight 11 API calls 18357->18358 18359 7ff784e560b7 18358->18359 18360 7ff784e560bf 18359->18360 18361 7ff784e5fe04 _get_daylight 11 API calls 18359->18361 18363 7ff784e560f7 18359->18363 18360->18300 18362 7ff784e560ec 18361->18362 18364 7ff784e5b464 __free_lconv_num 11 API calls 18362->18364 18363->18360 18528 7ff784e5fe8c 18363->18528 18364->18363 18367 7ff784e5b844 _isindst 17 API calls 18368 7ff784e5613c 18367->18368 18369 7ff784e5fe04 _get_daylight 11 API calls 18368->18369 18370 7ff784e56189 18369->18370 18371 7ff784e5b464 __free_lconv_num 11 API calls 18370->18371 18372 7ff784e56197 18371->18372 18373 7ff784e5fe04 _get_daylight 11 API calls 18372->18373 18377 7ff784e561c1 18372->18377 18374 7ff784e561b3 18373->18374 18376 7ff784e5b464 __free_lconv_num 11 API calls 18374->18376 18376->18377 18378 7ff784e561ca 18377->18378 18537 7ff784e602e0 18377->18537 18378->18300 18380 7ff784e41ccc 18379->18380 18381 7ff784e48950 2 API calls 18380->18381 18382 7ff784e41cf4 18381->18382 18383 7ff784e41d19 18382->18383 18384 7ff784e41cfe 18382->18384 18552 7ff784e41db0 18383->18552 18385 7ff784e41e00 78 API calls 18384->18385 18387 7ff784e41d17 18385->18387 18388 7ff784e4bb10 _log10_special 8 API calls 18387->18388 18389 7ff784e41d40 18388->18389 18389->18305 18391 7ff784e527f6 18390->18391 18392 7ff784e527e6 18390->18392 18393 7ff784e527ff 18391->18393 18398 7ff784e5282d 18391->18398 18396 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18392->18396 18394 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18393->18394 18395 7ff784e52825 18394->18395 18395->18349 18395->18350 18395->18351 18395->18354 18396->18395 18397 7ff784e55270 45 API calls 18397->18398 18398->18392 18398->18395 18398->18397 18400 7ff784e52adc 18398->18400 18404 7ff784e53b88 18398->18404 18430 7ff784e53268 18398->18430 18460 7ff784e52300 18398->18460 18402 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18400->18402 18402->18392 18405 7ff784e53c3d 18404->18405 18406 7ff784e53bca 18404->18406 18409 7ff784e53c97 18405->18409 18410 7ff784e53c42 18405->18410 18407 7ff784e53c67 18406->18407 18408 7ff784e53bd0 18406->18408 18477 7ff784e51128 18407->18477 18415 7ff784e53bd5 18408->18415 18419 7ff784e53ca6 18408->18419 18409->18407 18409->18419 18428 7ff784e53c00 18409->18428 18411 7ff784e53c77 18410->18411 18412 7ff784e53c44 18410->18412 18484 7ff784e50d18 18411->18484 18414 7ff784e53be5 18412->18414 18418 7ff784e53c53 18412->18418 18429 7ff784e53cd5 18414->18429 18463 7ff784e549b0 18414->18463 18415->18414 18420 7ff784e53c18 18415->18420 18415->18428 18418->18407 18422 7ff784e53c58 18418->18422 18419->18429 18491 7ff784e51538 18419->18491 18420->18429 18473 7ff784e54e6c 18420->18473 18425 7ff784e55004 37 API calls 18422->18425 18422->18429 18424 7ff784e4bb10 _log10_special 8 API calls 18426 7ff784e53f6b 18424->18426 18425->18428 18426->18398 18428->18429 18498 7ff784e5f920 18428->18498 18429->18424 18431 7ff784e53289 18430->18431 18432 7ff784e53273 18430->18432 18435 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18431->18435 18436 7ff784e532c7 18431->18436 18433 7ff784e53c3d 18432->18433 18434 7ff784e53bca 18432->18434 18432->18436 18439 7ff784e53c97 18433->18439 18440 7ff784e53c42 18433->18440 18437 7ff784e53c67 18434->18437 18438 7ff784e53bd0 18434->18438 18435->18436 18436->18398 18443 7ff784e51128 38 API calls 18437->18443 18447 7ff784e53bd5 18438->18447 18450 7ff784e53ca6 18438->18450 18439->18437 18439->18450 18458 7ff784e53c00 18439->18458 18441 7ff784e53c77 18440->18441 18442 7ff784e53c44 18440->18442 18445 7ff784e50d18 38 API calls 18441->18445 18444 7ff784e53be5 18442->18444 18448 7ff784e53c53 18442->18448 18443->18458 18446 7ff784e549b0 47 API calls 18444->18446 18459 7ff784e53cd5 18444->18459 18445->18458 18446->18458 18447->18444 18449 7ff784e53c18 18447->18449 18447->18458 18448->18437 18452 7ff784e53c58 18448->18452 18453 7ff784e54e6c 47 API calls 18449->18453 18449->18459 18451 7ff784e51538 38 API calls 18450->18451 18450->18459 18451->18458 18455 7ff784e55004 37 API calls 18452->18455 18452->18459 18453->18458 18454 7ff784e4bb10 _log10_special 8 API calls 18456 7ff784e53f6b 18454->18456 18455->18458 18456->18398 18457 7ff784e5f920 47 API calls 18457->18458 18458->18457 18458->18459 18459->18454 18511 7ff784e502ec 18460->18511 18464 7ff784e549d2 18463->18464 18465 7ff784e50158 12 API calls 18464->18465 18466 7ff784e54a1a 18465->18466 18467 7ff784e5f638 46 API calls 18466->18467 18468 7ff784e54aed 18467->18468 18469 7ff784e55270 45 API calls 18468->18469 18470 7ff784e54b0f 18468->18470 18469->18470 18471 7ff784e54b98 18470->18471 18472 7ff784e55270 45 API calls 18470->18472 18471->18428 18472->18471 18474 7ff784e54eec 18473->18474 18475 7ff784e54e84 18473->18475 18474->18428 18475->18474 18476 7ff784e5f920 47 API calls 18475->18476 18476->18474 18478 7ff784e5115b 18477->18478 18479 7ff784e5118a 18478->18479 18481 7ff784e51247 18478->18481 18480 7ff784e50158 12 API calls 18479->18480 18483 7ff784e511c7 18479->18483 18480->18483 18482 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18481->18482 18482->18483 18483->18428 18486 7ff784e50d4b 18484->18486 18485 7ff784e50d7a 18487 7ff784e50158 12 API calls 18485->18487 18490 7ff784e50db7 18485->18490 18486->18485 18488 7ff784e50e37 18486->18488 18487->18490 18489 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18488->18489 18489->18490 18490->18428 18492 7ff784e5156b 18491->18492 18493 7ff784e5159a 18492->18493 18495 7ff784e51657 18492->18495 18494 7ff784e50158 12 API calls 18493->18494 18497 7ff784e515d7 18493->18497 18494->18497 18496 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18495->18496 18496->18497 18497->18428 18500 7ff784e5f948 18498->18500 18499 7ff784e5f98d 18503 7ff784e5f976 memcpy_s 18499->18503 18507 7ff784e5f94d memcpy_s 18499->18507 18508 7ff784e61a58 18499->18508 18500->18499 18502 7ff784e55270 45 API calls 18500->18502 18500->18503 18500->18507 18501 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18501->18507 18502->18499 18503->18501 18503->18507 18507->18428 18510 7ff784e61a7c WideCharToMultiByte 18508->18510 18512 7ff784e5032b 18511->18512 18513 7ff784e50319 18511->18513 18515 7ff784e50375 18512->18515 18517 7ff784e50338 18512->18517 18514 7ff784e55e48 _get_daylight 11 API calls 18513->18514 18516 7ff784e5031e 18514->18516 18520 7ff784e5041e 18515->18520 18521 7ff784e55e48 _get_daylight 11 API calls 18515->18521 18518 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18516->18518 18519 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18517->18519 18525 7ff784e50329 18518->18525 18519->18525 18522 7ff784e55e48 _get_daylight 11 API calls 18520->18522 18520->18525 18523 7ff784e50413 18521->18523 18524 7ff784e504c8 18522->18524 18526 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18523->18526 18527 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18524->18527 18525->18398 18526->18520 18527->18525 18529 7ff784e5fea9 18528->18529 18531 7ff784e5feae 18529->18531 18533 7ff784e5611d 18529->18533 18534 7ff784e5fef8 18529->18534 18530 7ff784e55e48 _get_daylight 11 API calls 18536 7ff784e5feb8 18530->18536 18531->18530 18531->18533 18532 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18532->18533 18533->18360 18533->18367 18534->18533 18535 7ff784e55e48 _get_daylight 11 API calls 18534->18535 18535->18536 18536->18532 18542 7ff784e5ff7c 18537->18542 18540 7ff784e6031b 18540->18377 18541 7ff784e60335 InitializeCriticalSectionAndSpinCount 18541->18540 18548 7ff784e5ffd9 18542->18548 18550 7ff784e5ffd4 __vcrt_FlsAlloc 18542->18550 18543 7ff784e60009 LoadLibraryExW 18545 7ff784e600de 18543->18545 18546 7ff784e6002e GetLastError 18543->18546 18544 7ff784e600fe GetProcAddress 18544->18548 18549 7ff784e6010f 18544->18549 18545->18544 18547 7ff784e600f5 FreeLibrary 18545->18547 18546->18550 18547->18544 18548->18540 18548->18541 18549->18548 18550->18543 18550->18544 18550->18548 18551 7ff784e60068 LoadLibraryExW 18550->18551 18551->18545 18551->18550 18553 7ff784e41dd6 18552->18553 18556 7ff784e5567c 18553->18556 18555 7ff784e41dec 18555->18387 18557 7ff784e556a6 18556->18557 18558 7ff784e556de 18557->18558 18560 7ff784e55711 18557->18560 18559 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 18558->18559 18562 7ff784e55707 18559->18562 18563 7ff784e50118 18560->18563 18562->18555 18570 7ff784e562dc EnterCriticalSection 18563->18570 18572 7ff784e59194 18571->18572 18573 7ff784e59181 18571->18573 18581 7ff784e58df8 18572->18581 18574 7ff784e55e48 _get_daylight 11 API calls 18573->18574 18576 7ff784e59186 18574->18576 18578 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 18576->18578 18579 7ff784e59192 18578->18579 18579->17607 18588 7ff784e61548 EnterCriticalSection 18581->18588 18590 7ff784e47bf1 GetTokenInformation 18589->18590 18591 7ff784e47c73 __std_exception_copy 18589->18591 18592 7ff784e47c1d 18590->18592 18593 7ff784e47c12 GetLastError 18590->18593 18594 7ff784e47c8c 18591->18594 18595 7ff784e47c86 CloseHandle 18591->18595 18592->18591 18596 7ff784e47c39 GetTokenInformation 18592->18596 18593->18591 18593->18592 18594->17612 18595->18594 18596->18591 18597 7ff784e47c5c 18596->18597 18597->18591 18598 7ff784e47c66 ConvertSidToStringSidW 18597->18598 18598->18591 18600 7ff784e4be10 18599->18600 18601 7ff784e42244 GetCurrentProcessId 18600->18601 18602 7ff784e41d50 48 API calls 18601->18602 18603 7ff784e42295 18602->18603 18604 7ff784e55b18 48 API calls 18603->18604 18605 7ff784e422d3 18604->18605 18606 7ff784e41e00 78 API calls 18605->18606 18607 7ff784e422f1 18606->18607 18608 7ff784e4bb10 _log10_special 8 API calls 18607->18608 18609 7ff784e42301 18608->18609 18609->17622 18611 7ff784e48785 18610->18611 18612 7ff784e55b18 48 API calls 18611->18612 18613 7ff784e487a4 18612->18613 18613->17637 18618 7ff784e4761c 18617->18618 18619 7ff784e48950 2 API calls 18618->18619 18620 7ff784e4763b 18619->18620 18882 7ff784e4397a 18881->18882 18883 7ff784e48950 2 API calls 18882->18883 18884 7ff784e4399f 18883->18884 18885 7ff784e4bb10 _log10_special 8 API calls 18884->18885 18886 7ff784e439c7 18885->18886 18886->17675 18888 7ff784e4726e 18887->18888 18889 7ff784e41c60 49 API calls 18888->18889 18890 7ff784e47392 18888->18890 18895 7ff784e472f5 18889->18895 18891 7ff784e4bb10 _log10_special 8 API calls 18890->18891 18892 7ff784e473c3 18891->18892 18892->17675 18893 7ff784e41c60 49 API calls 18893->18895 18894 7ff784e43970 10 API calls 18894->18895 18895->18890 18895->18893 18895->18894 18896 7ff784e48950 2 API calls 18895->18896 18897 7ff784e47363 CreateDirectoryW 18896->18897 18897->18890 18897->18895 18899 7ff784e41617 18898->18899 18900 7ff784e415f3 18898->18900 18902 7ff784e439d0 108 API calls 18899->18902 19019 7ff784e41030 18900->19019 18904 7ff784e4162b 18902->18904 18906 7ff784e41662 18904->18906 18907 7ff784e41633 18904->18907 18908 7ff784e439d0 108 API calls 18906->18908 18910 7ff784e55e48 _get_daylight 11 API calls 18907->18910 18948 7ff784e465cb 18946->18948 18949 7ff784e46584 18946->18949 18948->17675 18949->18948 19083 7ff784e55f64 18949->19083 18951 7ff784e435b1 18950->18951 18952 7ff784e438f0 49 API calls 18951->18952 18953 7ff784e435eb 18952->18953 18954 7ff784e438f0 49 API calls 18953->18954 18955 7ff784e435fb 18954->18955 18956 7ff784e4361d 18955->18956 18957 7ff784e4364c 18955->18957 18995 7ff784e41c60 49 API calls 18994->18995 18996 7ff784e43884 18995->18996 18996->17675 19020 7ff784e439d0 108 API calls 19019->19020 19021 7ff784e4106c 19020->19021 19022 7ff784e41089 19021->19022 19023 7ff784e41074 19021->19023 19025 7ff784e4fc2c 73 API calls 19022->19025 19024 7ff784e41e50 81 API calls 19023->19024 19084 7ff784e55f71 19083->19084 19086 7ff784e55f9e 19083->19086 19085 7ff784e55e48 _get_daylight 11 API calls 19084->19085 19094 7ff784e55f28 19084->19094 19089 7ff784e55f7b 19085->19089 19087 7ff784e55fc1 19086->19087 19088 7ff784e55fdd 19086->19088 19090 7ff784e55e48 _get_daylight 11 API calls 19087->19090 19098 7ff784e55e8c 19088->19098 19093 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 19089->19093 19091 7ff784e55fc6 19090->19091 19094->18949 19099 7ff784e55eb0 19098->19099 19105 7ff784e55eab 19098->19105 19099->19105 19178 7ff784e56e88 19177->19178 19179 7ff784e56eae 19178->19179 19181 7ff784e56ee1 19178->19181 19180 7ff784e55e48 _get_daylight 11 API calls 19179->19180 19182 7ff784e56eb3 19180->19182 19183 7ff784e56ee7 19181->19183 19184 7ff784e56ef4 19181->19184 19185 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 19182->19185 19186 7ff784e55e48 _get_daylight 11 API calls 19183->19186 19196 7ff784e5bb30 19184->19196 19188 7ff784e43a26 19185->19188 19186->19188 19188->17700 19209 7ff784e61548 EnterCriticalSection 19196->19209 19569 7ff784e58834 19568->19569 19572 7ff784e58310 19569->19572 19571 7ff784e5884d 19571->17710 19573 7ff784e5832b 19572->19573 19574 7ff784e5835a 19572->19574 19575 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 19573->19575 19582 7ff784e562dc EnterCriticalSection 19574->19582 19581 7ff784e5834b 19575->19581 19581->19571 19584 7ff784e4f39b 19583->19584 19585 7ff784e4f3c9 19583->19585 19586 7ff784e5b758 _invalid_parameter_noinfo 37 API calls 19584->19586 19587 7ff784e4f3bb 19585->19587 19593 7ff784e562dc EnterCriticalSection 19585->19593 19586->19587 19587->17714 19595 7ff784e439d0 108 API calls 19594->19595 19596 7ff784e41473 19595->19596 19701 7ff784e457b5 19700->19701 19702 7ff784e41c60 49 API calls 19701->19702 19703 7ff784e457f1 19702->19703 19704 7ff784e457fa 19703->19704 19705 7ff784e4581d 19703->19705 19706 7ff784e41e50 81 API calls 19704->19706 19707 7ff784e43a40 49 API calls 19705->19707 19730 7ff784e45813 19706->19730 19708 7ff784e45835 19707->19708 19990 7ff784e5c050 __CxxCallCatchBlock 45 API calls 19989->19990 19991 7ff784e5b361 19990->19991 19994 7ff784e5b40c 19991->19994 20003 7ff784e648c0 19994->20003 20029 7ff784e64878 20003->20029 20034 7ff784e61548 EnterCriticalSection 20029->20034 21444 7ff784e56280 21445 7ff784e5628b 21444->21445 21453 7ff784e60514 21445->21453 21466 7ff784e61548 EnterCriticalSection 21453->21466 21467 7ff784e6c06e 21468 7ff784e6c07d 21467->21468 21469 7ff784e6c087 21467->21469 21471 7ff784e615a8 LeaveCriticalSection 21468->21471 20828 7ff784e6bfd9 20831 7ff784e562e8 LeaveCriticalSection 20828->20831 20656 7ff784e565e4 20657 7ff784e5661b 20656->20657 20658 7ff784e565fe 20656->20658 20657->20658 20660 7ff784e5662e CreateFileW 20657->20660 20659 7ff784e55e28 _fread_nolock 11 API calls 20658->20659 20661 7ff784e56603 20659->20661 20662 7ff784e56698 20660->20662 20663 7ff784e56662 20660->20663 20665 7ff784e55e48 _get_daylight 11 API calls 20661->20665 20707 7ff784e56bc0 20662->20707 20681 7ff784e56738 GetFileType 20663->20681 20668 7ff784e5660b 20665->20668 20672 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20668->20672 20670 7ff784e566cc 20728 7ff784e56980 20670->20728 20671 7ff784e566a1 20676 7ff784e55dbc _fread_nolock 11 API calls 20671->20676 20675 7ff784e56616 20672->20675 20673 7ff784e5668d CloseHandle 20673->20675 20674 7ff784e56677 CloseHandle 20674->20675 20678 7ff784e566ab 20676->20678 20678->20675 20682 7ff784e56843 20681->20682 20683 7ff784e56786 20681->20683 20685 7ff784e5684b 20682->20685 20686 7ff784e5686d 20682->20686 20684 7ff784e567b2 GetFileInformationByHandle 20683->20684 20688 7ff784e56abc 21 API calls 20683->20688 20689 7ff784e567db 20684->20689 20690 7ff784e5685e GetLastError 20684->20690 20685->20690 20691 7ff784e5684f 20685->20691 20687 7ff784e56890 PeekNamedPipe 20686->20687 20706 7ff784e5682e 20686->20706 20687->20706 20693 7ff784e567a0 20688->20693 20694 7ff784e56980 51 API calls 20689->20694 20692 7ff784e55dbc _fread_nolock 11 API calls 20690->20692 20695 7ff784e55e48 _get_daylight 11 API calls 20691->20695 20692->20706 20693->20684 20693->20706 20696 7ff784e567e6 20694->20696 20695->20706 20745 7ff784e568e0 20696->20745 20697 7ff784e4bb10 _log10_special 8 API calls 20699 7ff784e56670 20697->20699 20699->20673 20699->20674 20701 7ff784e568e0 10 API calls 20702 7ff784e56805 20701->20702 20703 7ff784e568e0 10 API calls 20702->20703 20704 7ff784e56816 20703->20704 20705 7ff784e55e48 _get_daylight 11 API calls 20704->20705 20704->20706 20705->20706 20706->20697 20708 7ff784e56bf6 20707->20708 20709 7ff784e56c8e __std_exception_copy 20708->20709 20710 7ff784e55e48 _get_daylight 11 API calls 20708->20710 20712 7ff784e4bb10 _log10_special 8 API calls 20709->20712 20711 7ff784e56c08 20710->20711 20714 7ff784e55e48 _get_daylight 11 API calls 20711->20714 20713 7ff784e5669d 20712->20713 20713->20670 20713->20671 20715 7ff784e56c10 20714->20715 20716 7ff784e58d44 45 API calls 20715->20716 20717 7ff784e56c25 20716->20717 20718 7ff784e56c2d 20717->20718 20719 7ff784e56c37 20717->20719 20720 7ff784e55e48 _get_daylight 11 API calls 20718->20720 20721 7ff784e55e48 _get_daylight 11 API calls 20719->20721 20724 7ff784e56c32 20720->20724 20722 7ff784e56c3c 20721->20722 20722->20709 20723 7ff784e55e48 _get_daylight 11 API calls 20722->20723 20725 7ff784e56c46 20723->20725 20724->20709 20726 7ff784e56c80 GetDriveTypeW 20724->20726 20727 7ff784e58d44 45 API calls 20725->20727 20726->20709 20727->20724 20729 7ff784e569a8 20728->20729 20737 7ff784e566d9 20729->20737 20752 7ff784e60994 20729->20752 20731 7ff784e56a3c 20732 7ff784e60994 51 API calls 20731->20732 20731->20737 20733 7ff784e56a4f 20732->20733 20734 7ff784e60994 51 API calls 20733->20734 20733->20737 20735 7ff784e56a62 20734->20735 20736 7ff784e60994 51 API calls 20735->20736 20735->20737 20736->20737 20738 7ff784e56abc 20737->20738 20739 7ff784e56ad6 20738->20739 20740 7ff784e56b0d 20739->20740 20741 7ff784e56ae6 20739->20741 20742 7ff784e60828 21 API calls 20740->20742 20743 7ff784e55dbc _fread_nolock 11 API calls 20741->20743 20744 7ff784e56af6 20741->20744 20742->20744 20743->20744 20744->20678 20746 7ff784e568fc 20745->20746 20747 7ff784e56909 FileTimeToSystemTime 20745->20747 20746->20747 20748 7ff784e56904 20746->20748 20747->20748 20749 7ff784e5691d SystemTimeToTzSpecificLocalTime 20747->20749 20750 7ff784e4bb10 _log10_special 8 API calls 20748->20750 20749->20748 20751 7ff784e567f5 20750->20751 20751->20701 20753 7ff784e609c5 20752->20753 20754 7ff784e609a1 20752->20754 20757 7ff784e609ff 20753->20757 20760 7ff784e60a1e 20753->20760 20754->20753 20755 7ff784e609a6 20754->20755 20756 7ff784e55e48 _get_daylight 11 API calls 20755->20756 20758 7ff784e609ab 20756->20758 20759 7ff784e55e48 _get_daylight 11 API calls 20757->20759 20762 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20758->20762 20763 7ff784e60a04 20759->20763 20761 7ff784e55e8c 45 API calls 20760->20761 20766 7ff784e60a2b 20761->20766 20764 7ff784e609b6 20762->20764 20765 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20763->20765 20764->20731 20767 7ff784e60a0f 20765->20767 20766->20767 20768 7ff784e6174c 51 API calls 20766->20768 20767->20731 20768->20766 21531 7ff784e6be53 21532 7ff784e6be63 21531->21532 21535 7ff784e562e8 LeaveCriticalSection 21532->21535 21275 7ff784e626d0 21293 7ff784e61548 EnterCriticalSection 21275->21293 21294 7ff784e5bed0 21295 7ff784e5bed5 21294->21295 21299 7ff784e5beea 21294->21299 21300 7ff784e5bef0 21295->21300 21301 7ff784e5bf3a 21300->21301 21302 7ff784e5bf32 21300->21302 21304 7ff784e5b464 __free_lconv_num 11 API calls 21301->21304 21303 7ff784e5b464 __free_lconv_num 11 API calls 21302->21303 21303->21301 21305 7ff784e5bf47 21304->21305 21306 7ff784e5b464 __free_lconv_num 11 API calls 21305->21306 21307 7ff784e5bf54 21306->21307 21308 7ff784e5b464 __free_lconv_num 11 API calls 21307->21308 21309 7ff784e5bf61 21308->21309 21310 7ff784e5b464 __free_lconv_num 11 API calls 21309->21310 21311 7ff784e5bf6e 21310->21311 21312 7ff784e5b464 __free_lconv_num 11 API calls 21311->21312 21313 7ff784e5bf7b 21312->21313 21314 7ff784e5b464 __free_lconv_num 11 API calls 21313->21314 21315 7ff784e5bf88 21314->21315 21316 7ff784e5b464 __free_lconv_num 11 API calls 21315->21316 21317 7ff784e5bf95 21316->21317 21318 7ff784e5b464 __free_lconv_num 11 API calls 21317->21318 21319 7ff784e5bfa5 21318->21319 21320 7ff784e5b464 __free_lconv_num 11 API calls 21319->21320 21321 7ff784e5bfb5 21320->21321 21326 7ff784e5bd9c 21321->21326 21340 7ff784e61548 EnterCriticalSection 21326->21340 21342 7ff784e5acd0 21345 7ff784e5ac48 21342->21345 21352 7ff784e61548 EnterCriticalSection 21345->21352 20038 7ff784e61b38 20039 7ff784e61b5c 20038->20039 20042 7ff784e61b6c 20038->20042 20040 7ff784e55e48 _get_daylight 11 API calls 20039->20040 20063 7ff784e61b61 20040->20063 20041 7ff784e61e4c 20044 7ff784e55e48 _get_daylight 11 API calls 20041->20044 20042->20041 20043 7ff784e61b8e 20042->20043 20046 7ff784e61baf 20043->20046 20169 7ff784e621f4 20043->20169 20045 7ff784e61e51 20044->20045 20047 7ff784e5b464 __free_lconv_num 11 API calls 20045->20047 20049 7ff784e61c21 20046->20049 20051 7ff784e61bd5 20046->20051 20055 7ff784e61c15 20046->20055 20047->20063 20053 7ff784e5fe04 _get_daylight 11 API calls 20049->20053 20067 7ff784e61be4 20049->20067 20050 7ff784e61cce 20062 7ff784e61ceb 20050->20062 20068 7ff784e61d3d 20050->20068 20184 7ff784e5a5fc 20051->20184 20056 7ff784e61c37 20053->20056 20055->20050 20055->20067 20190 7ff784e6839c 20055->20190 20059 7ff784e5b464 __free_lconv_num 11 API calls 20056->20059 20058 7ff784e5b464 __free_lconv_num 11 API calls 20058->20063 20064 7ff784e61c45 20059->20064 20060 7ff784e61bfd 20060->20055 20070 7ff784e621f4 45 API calls 20060->20070 20061 7ff784e61bdf 20065 7ff784e55e48 _get_daylight 11 API calls 20061->20065 20066 7ff784e5b464 __free_lconv_num 11 API calls 20062->20066 20064->20055 20064->20067 20072 7ff784e5fe04 _get_daylight 11 API calls 20064->20072 20065->20067 20069 7ff784e61cf4 20066->20069 20067->20058 20068->20067 20071 7ff784e6464c 40 API calls 20068->20071 20078 7ff784e61cf9 20069->20078 20226 7ff784e6464c 20069->20226 20070->20055 20073 7ff784e61d7a 20071->20073 20075 7ff784e61c67 20072->20075 20076 7ff784e5b464 __free_lconv_num 11 API calls 20073->20076 20080 7ff784e5b464 __free_lconv_num 11 API calls 20075->20080 20081 7ff784e61d84 20076->20081 20077 7ff784e61d25 20082 7ff784e5b464 __free_lconv_num 11 API calls 20077->20082 20079 7ff784e61e40 20078->20079 20084 7ff784e5fe04 _get_daylight 11 API calls 20078->20084 20083 7ff784e5b464 __free_lconv_num 11 API calls 20079->20083 20080->20055 20081->20067 20081->20078 20082->20078 20083->20063 20085 7ff784e61dc8 20084->20085 20086 7ff784e61dd9 20085->20086 20087 7ff784e61dd0 20085->20087 20089 7ff784e5b3ac __std_exception_copy 37 API calls 20086->20089 20088 7ff784e5b464 __free_lconv_num 11 API calls 20087->20088 20090 7ff784e61dd7 20088->20090 20091 7ff784e61de8 20089->20091 20095 7ff784e5b464 __free_lconv_num 11 API calls 20090->20095 20092 7ff784e61e7b 20091->20092 20093 7ff784e61df0 20091->20093 20094 7ff784e5b844 _isindst 17 API calls 20092->20094 20235 7ff784e684b4 20093->20235 20098 7ff784e61e8f 20094->20098 20095->20063 20101 7ff784e61eb8 20098->20101 20109 7ff784e61ec8 20098->20109 20099 7ff784e61e38 20104 7ff784e5b464 __free_lconv_num 11 API calls 20099->20104 20100 7ff784e61e17 20102 7ff784e55e48 _get_daylight 11 API calls 20100->20102 20103 7ff784e55e48 _get_daylight 11 API calls 20101->20103 20105 7ff784e61e1c 20102->20105 20106 7ff784e61ebd 20103->20106 20104->20079 20107 7ff784e5b464 __free_lconv_num 11 API calls 20105->20107 20107->20090 20108 7ff784e621ab 20111 7ff784e55e48 _get_daylight 11 API calls 20108->20111 20109->20108 20110 7ff784e61eea 20109->20110 20113 7ff784e61f07 20110->20113 20254 7ff784e622dc 20110->20254 20112 7ff784e621b0 20111->20112 20115 7ff784e5b464 __free_lconv_num 11 API calls 20112->20115 20116 7ff784e61f7b 20113->20116 20117 7ff784e61f6f 20113->20117 20118 7ff784e61f2f 20113->20118 20115->20106 20121 7ff784e5fe04 _get_daylight 11 API calls 20116->20121 20134 7ff784e61f3e 20116->20134 20138 7ff784e61fa3 20116->20138 20131 7ff784e6202e 20117->20131 20117->20134 20275 7ff784e6825c 20117->20275 20269 7ff784e5a638 20118->20269 20125 7ff784e61f95 20121->20125 20123 7ff784e5fe04 _get_daylight 11 API calls 20129 7ff784e61fc5 20123->20129 20124 7ff784e5b464 __free_lconv_num 11 API calls 20124->20106 20132 7ff784e5b464 __free_lconv_num 11 API calls 20125->20132 20126 7ff784e61f57 20126->20117 20137 7ff784e622dc 45 API calls 20126->20137 20127 7ff784e61f39 20133 7ff784e55e48 _get_daylight 11 API calls 20127->20133 20128 7ff784e6209e 20128->20134 20140 7ff784e6464c 40 API calls 20128->20140 20135 7ff784e5b464 __free_lconv_num 11 API calls 20129->20135 20130 7ff784e6204b 20136 7ff784e5b464 __free_lconv_num 11 API calls 20130->20136 20131->20128 20131->20130 20132->20138 20133->20134 20134->20124 20135->20117 20139 7ff784e62054 20136->20139 20137->20117 20138->20117 20138->20123 20138->20134 20143 7ff784e6464c 40 API calls 20139->20143 20145 7ff784e6205a 20139->20145 20141 7ff784e620dc 20140->20141 20142 7ff784e5b464 __free_lconv_num 11 API calls 20141->20142 20144 7ff784e620e6 20142->20144 20147 7ff784e62086 20143->20147 20144->20134 20144->20145 20146 7ff784e6219f 20145->20146 20150 7ff784e5fe04 _get_daylight 11 API calls 20145->20150 20149 7ff784e5b464 __free_lconv_num 11 API calls 20146->20149 20148 7ff784e5b464 __free_lconv_num 11 API calls 20147->20148 20148->20145 20149->20106 20151 7ff784e6212b 20150->20151 20152 7ff784e6213c 20151->20152 20153 7ff784e62133 20151->20153 20155 7ff784e616e4 37 API calls 20152->20155 20154 7ff784e5b464 __free_lconv_num 11 API calls 20153->20154 20156 7ff784e6213a 20154->20156 20157 7ff784e6214a 20155->20157 20163 7ff784e5b464 __free_lconv_num 11 API calls 20156->20163 20158 7ff784e621df 20157->20158 20159 7ff784e62152 SetEnvironmentVariableW 20157->20159 20162 7ff784e5b844 _isindst 17 API calls 20158->20162 20160 7ff784e62197 20159->20160 20161 7ff784e62176 20159->20161 20166 7ff784e5b464 __free_lconv_num 11 API calls 20160->20166 20164 7ff784e55e48 _get_daylight 11 API calls 20161->20164 20165 7ff784e621f3 20162->20165 20163->20106 20167 7ff784e6217b 20164->20167 20166->20146 20168 7ff784e5b464 __free_lconv_num 11 API calls 20167->20168 20168->20156 20170 7ff784e62229 20169->20170 20171 7ff784e62211 20169->20171 20172 7ff784e5fe04 _get_daylight 11 API calls 20170->20172 20171->20046 20173 7ff784e6224d 20172->20173 20174 7ff784e622ae 20173->20174 20178 7ff784e5fe04 _get_daylight 11 API calls 20173->20178 20179 7ff784e5b464 __free_lconv_num 11 API calls 20173->20179 20180 7ff784e5b3ac __std_exception_copy 37 API calls 20173->20180 20181 7ff784e622bd 20173->20181 20183 7ff784e622d2 20173->20183 20177 7ff784e5b464 __free_lconv_num 11 API calls 20174->20177 20175 7ff784e5b40c __CxxCallCatchBlock 45 API calls 20176 7ff784e622d8 20175->20176 20177->20171 20178->20173 20179->20173 20180->20173 20182 7ff784e5b844 _isindst 17 API calls 20181->20182 20182->20183 20183->20175 20185 7ff784e5a60c 20184->20185 20188 7ff784e5a615 20184->20188 20185->20188 20299 7ff784e5a0d4 20185->20299 20188->20060 20188->20061 20191 7ff784e683a9 20190->20191 20192 7ff784e674c4 20190->20192 20194 7ff784e55e8c 45 API calls 20191->20194 20193 7ff784e674d1 20192->20193 20200 7ff784e67507 20192->20200 20197 7ff784e55e48 _get_daylight 11 API calls 20193->20197 20209 7ff784e67478 20193->20209 20195 7ff784e683dd 20194->20195 20202 7ff784e683f3 20195->20202 20206 7ff784e6840a 20195->20206 20225 7ff784e683e2 20195->20225 20196 7ff784e67531 20198 7ff784e55e48 _get_daylight 11 API calls 20196->20198 20199 7ff784e674db 20197->20199 20201 7ff784e67536 20198->20201 20203 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20199->20203 20200->20196 20204 7ff784e67556 20200->20204 20205 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20201->20205 20207 7ff784e55e48 _get_daylight 11 API calls 20202->20207 20208 7ff784e674e6 20203->20208 20213 7ff784e55e8c 45 API calls 20204->20213 20218 7ff784e67541 20204->20218 20205->20218 20211 7ff784e68426 20206->20211 20212 7ff784e68414 20206->20212 20210 7ff784e683f8 20207->20210 20208->20055 20209->20055 20216 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20210->20216 20214 7ff784e6844e 20211->20214 20215 7ff784e68437 20211->20215 20217 7ff784e55e48 _get_daylight 11 API calls 20212->20217 20213->20218 20525 7ff784e6a1bc 20214->20525 20516 7ff784e67514 20215->20516 20216->20225 20221 7ff784e68419 20217->20221 20218->20055 20223 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20221->20223 20223->20225 20224 7ff784e55e48 _get_daylight 11 API calls 20224->20225 20225->20055 20227 7ff784e6468b 20226->20227 20228 7ff784e6466e 20226->20228 20230 7ff784e64695 20227->20230 20565 7ff784e68ea8 20227->20565 20228->20227 20229 7ff784e6467c 20228->20229 20231 7ff784e55e48 _get_daylight 11 API calls 20229->20231 20572 7ff784e68ee4 20230->20572 20234 7ff784e64681 memcpy_s 20231->20234 20234->20077 20236 7ff784e55e8c 45 API calls 20235->20236 20237 7ff784e6851a 20236->20237 20238 7ff784e68528 20237->20238 20584 7ff784e60190 20237->20584 20587 7ff784e56468 20238->20587 20242 7ff784e68614 20245 7ff784e68625 20242->20245 20247 7ff784e5b464 __free_lconv_num 11 API calls 20242->20247 20243 7ff784e55e8c 45 API calls 20244 7ff784e68597 20243->20244 20246 7ff784e685a0 20244->20246 20250 7ff784e60190 5 API calls 20244->20250 20248 7ff784e61e13 20245->20248 20249 7ff784e5b464 __free_lconv_num 11 API calls 20245->20249 20251 7ff784e56468 14 API calls 20246->20251 20247->20245 20248->20099 20248->20100 20249->20248 20250->20246 20252 7ff784e685fb 20251->20252 20252->20242 20253 7ff784e68603 SetEnvironmentVariableW 20252->20253 20253->20242 20255 7ff784e6231c 20254->20255 20262 7ff784e622ff 20254->20262 20256 7ff784e5fe04 _get_daylight 11 API calls 20255->20256 20264 7ff784e62340 20256->20264 20257 7ff784e623c4 20259 7ff784e5b40c __CxxCallCatchBlock 45 API calls 20257->20259 20258 7ff784e623a1 20260 7ff784e5b464 __free_lconv_num 11 API calls 20258->20260 20261 7ff784e623ca 20259->20261 20260->20262 20262->20113 20263 7ff784e5fe04 _get_daylight 11 API calls 20263->20264 20264->20257 20264->20258 20264->20263 20265 7ff784e5b464 __free_lconv_num 11 API calls 20264->20265 20266 7ff784e616e4 37 API calls 20264->20266 20267 7ff784e623b0 20264->20267 20265->20264 20266->20264 20268 7ff784e5b844 _isindst 17 API calls 20267->20268 20268->20257 20270 7ff784e5a651 20269->20270 20271 7ff784e5a648 20269->20271 20270->20126 20270->20127 20271->20270 20272 7ff784e5a148 40 API calls 20271->20272 20273 7ff784e5a65a 20272->20273 20273->20270 20274 7ff784e5a508 12 API calls 20273->20274 20274->20270 20276 7ff784e68269 20275->20276 20281 7ff784e68296 20275->20281 20277 7ff784e6826e 20276->20277 20276->20281 20278 7ff784e55e48 _get_daylight 11 API calls 20277->20278 20279 7ff784e68273 20278->20279 20282 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20279->20282 20280 7ff784e682da 20284 7ff784e55e48 _get_daylight 11 API calls 20280->20284 20281->20280 20283 7ff784e682f9 20281->20283 20297 7ff784e682ce __crtLCMapStringW 20281->20297 20286 7ff784e6827e 20282->20286 20287 7ff784e68315 20283->20287 20288 7ff784e68303 20283->20288 20285 7ff784e682df 20284->20285 20289 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20285->20289 20286->20117 20291 7ff784e55e8c 45 API calls 20287->20291 20290 7ff784e55e48 _get_daylight 11 API calls 20288->20290 20289->20297 20292 7ff784e68308 20290->20292 20293 7ff784e68322 20291->20293 20294 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20292->20294 20293->20297 20609 7ff784e69d78 20293->20609 20294->20297 20297->20117 20298 7ff784e55e48 _get_daylight 11 API calls 20298->20297 20300 7ff784e5a0ed 20299->20300 20301 7ff784e5a0e9 20299->20301 20322 7ff784e63860 20300->20322 20301->20188 20314 7ff784e5a428 20301->20314 20306 7ff784e5a10b 20348 7ff784e5a1b8 20306->20348 20307 7ff784e5a0ff 20308 7ff784e5b464 __free_lconv_num 11 API calls 20307->20308 20308->20301 20311 7ff784e5b464 __free_lconv_num 11 API calls 20312 7ff784e5a132 20311->20312 20313 7ff784e5b464 __free_lconv_num 11 API calls 20312->20313 20313->20301 20315 7ff784e5a451 20314->20315 20320 7ff784e5a46a 20314->20320 20315->20188 20316 7ff784e5fe04 _get_daylight 11 API calls 20316->20320 20317 7ff784e5a4fa 20319 7ff784e5b464 __free_lconv_num 11 API calls 20317->20319 20318 7ff784e61a58 WideCharToMultiByte 20318->20320 20319->20315 20320->20315 20320->20316 20320->20317 20320->20318 20321 7ff784e5b464 __free_lconv_num 11 API calls 20320->20321 20321->20320 20323 7ff784e6386d 20322->20323 20327 7ff784e5a0f2 20322->20327 20367 7ff784e5c124 20323->20367 20328 7ff784e63b9c GetEnvironmentStringsW 20327->20328 20329 7ff784e63bcc 20328->20329 20330 7ff784e5a0f7 20328->20330 20331 7ff784e61a58 WideCharToMultiByte 20329->20331 20330->20306 20330->20307 20333 7ff784e63c1d 20331->20333 20332 7ff784e63c24 FreeEnvironmentStringsW 20332->20330 20333->20332 20334 7ff784e5e6c4 _fread_nolock 12 API calls 20333->20334 20335 7ff784e63c37 20334->20335 20336 7ff784e63c48 20335->20336 20337 7ff784e63c3f 20335->20337 20339 7ff784e61a58 WideCharToMultiByte 20336->20339 20338 7ff784e5b464 __free_lconv_num 11 API calls 20337->20338 20340 7ff784e63c46 20338->20340 20341 7ff784e63c6b 20339->20341 20340->20332 20342 7ff784e63c79 20341->20342 20343 7ff784e63c6f 20341->20343 20345 7ff784e5b464 __free_lconv_num 11 API calls 20342->20345 20344 7ff784e5b464 __free_lconv_num 11 API calls 20343->20344 20346 7ff784e63c77 FreeEnvironmentStringsW 20344->20346 20345->20346 20346->20330 20350 7ff784e5a1dd 20348->20350 20349 7ff784e5fe04 _get_daylight 11 API calls 20361 7ff784e5a213 20349->20361 20350->20349 20351 7ff784e5a21b 20352 7ff784e5b464 __free_lconv_num 11 API calls 20351->20352 20353 7ff784e5a113 20352->20353 20353->20311 20354 7ff784e5a28e 20355 7ff784e5b464 __free_lconv_num 11 API calls 20354->20355 20355->20353 20356 7ff784e5fe04 _get_daylight 11 API calls 20356->20361 20357 7ff784e5a27d 20358 7ff784e5a3e4 11 API calls 20357->20358 20360 7ff784e5a285 20358->20360 20359 7ff784e5b3ac __std_exception_copy 37 API calls 20359->20361 20363 7ff784e5b464 __free_lconv_num 11 API calls 20360->20363 20361->20351 20361->20354 20361->20356 20361->20357 20361->20359 20362 7ff784e5a2b3 20361->20362 20364 7ff784e5b464 __free_lconv_num 11 API calls 20361->20364 20365 7ff784e5b844 _isindst 17 API calls 20362->20365 20363->20351 20364->20361 20366 7ff784e5a2c6 20365->20366 20368 7ff784e5c135 FlsGetValue 20367->20368 20369 7ff784e5c150 FlsSetValue 20367->20369 20371 7ff784e5c142 20368->20371 20372 7ff784e5c14a 20368->20372 20370 7ff784e5c15d 20369->20370 20369->20371 20373 7ff784e5fe04 _get_daylight 11 API calls 20370->20373 20374 7ff784e5c148 20371->20374 20375 7ff784e5b40c __CxxCallCatchBlock 45 API calls 20371->20375 20372->20369 20377 7ff784e5c16c 20373->20377 20387 7ff784e63534 20374->20387 20376 7ff784e5c1c5 20375->20376 20378 7ff784e5c18a FlsSetValue 20377->20378 20379 7ff784e5c17a FlsSetValue 20377->20379 20381 7ff784e5c1a8 20378->20381 20382 7ff784e5c196 FlsSetValue 20378->20382 20380 7ff784e5c183 20379->20380 20383 7ff784e5b464 __free_lconv_num 11 API calls 20380->20383 20384 7ff784e5bdfc _get_daylight 11 API calls 20381->20384 20382->20380 20383->20371 20385 7ff784e5c1b0 20384->20385 20386 7ff784e5b464 __free_lconv_num 11 API calls 20385->20386 20386->20374 20410 7ff784e637a4 20387->20410 20389 7ff784e63569 20425 7ff784e63234 20389->20425 20392 7ff784e63586 20392->20327 20393 7ff784e5e6c4 _fread_nolock 12 API calls 20394 7ff784e63597 20393->20394 20395 7ff784e6359f 20394->20395 20397 7ff784e635ae 20394->20397 20396 7ff784e5b464 __free_lconv_num 11 API calls 20395->20396 20396->20392 20397->20397 20432 7ff784e638dc 20397->20432 20400 7ff784e636aa 20401 7ff784e55e48 _get_daylight 11 API calls 20400->20401 20402 7ff784e636af 20401->20402 20405 7ff784e5b464 __free_lconv_num 11 API calls 20402->20405 20403 7ff784e63705 20404 7ff784e6376c 20403->20404 20443 7ff784e63064 20403->20443 20408 7ff784e5b464 __free_lconv_num 11 API calls 20404->20408 20405->20392 20406 7ff784e636c4 20406->20403 20409 7ff784e5b464 __free_lconv_num 11 API calls 20406->20409 20408->20392 20409->20403 20411 7ff784e637c7 20410->20411 20412 7ff784e637d1 20411->20412 20458 7ff784e61548 EnterCriticalSection 20411->20458 20415 7ff784e63843 20412->20415 20417 7ff784e5b40c __CxxCallCatchBlock 45 API calls 20412->20417 20415->20389 20418 7ff784e6385b 20417->20418 20420 7ff784e638b2 20418->20420 20422 7ff784e5c124 50 API calls 20418->20422 20420->20389 20423 7ff784e6389c 20422->20423 20424 7ff784e63534 65 API calls 20423->20424 20424->20420 20426 7ff784e55e8c 45 API calls 20425->20426 20427 7ff784e63248 20426->20427 20428 7ff784e63254 GetOEMCP 20427->20428 20429 7ff784e63266 20427->20429 20430 7ff784e6327b 20428->20430 20429->20430 20431 7ff784e6326b GetACP 20429->20431 20430->20392 20430->20393 20431->20430 20433 7ff784e63234 47 API calls 20432->20433 20434 7ff784e63909 20433->20434 20435 7ff784e63a5f 20434->20435 20437 7ff784e63946 IsValidCodePage 20434->20437 20442 7ff784e63960 memcpy_s 20434->20442 20436 7ff784e4bb10 _log10_special 8 API calls 20435->20436 20438 7ff784e636a1 20436->20438 20437->20435 20439 7ff784e63957 20437->20439 20438->20400 20438->20406 20440 7ff784e63986 GetCPInfo 20439->20440 20439->20442 20440->20435 20440->20442 20459 7ff784e6334c 20442->20459 20515 7ff784e61548 EnterCriticalSection 20443->20515 20460 7ff784e63389 GetCPInfo 20459->20460 20469 7ff784e6347f 20459->20469 20464 7ff784e6339c 20460->20464 20460->20469 20461 7ff784e4bb10 _log10_special 8 API calls 20463 7ff784e6351e 20461->20463 20462 7ff784e640b0 48 API calls 20465 7ff784e63413 20462->20465 20463->20435 20464->20462 20470 7ff784e68df4 20465->20470 20468 7ff784e68df4 54 API calls 20468->20469 20469->20461 20471 7ff784e55e8c 45 API calls 20470->20471 20472 7ff784e68e19 20471->20472 20475 7ff784e68ac0 20472->20475 20476 7ff784e68b01 20475->20476 20477 7ff784e60b10 _fread_nolock MultiByteToWideChar 20476->20477 20480 7ff784e68b4b 20477->20480 20478 7ff784e68dc9 20479 7ff784e4bb10 _log10_special 8 API calls 20478->20479 20481 7ff784e63446 20479->20481 20480->20478 20482 7ff784e68c81 20480->20482 20483 7ff784e5e6c4 _fread_nolock 12 API calls 20480->20483 20485 7ff784e68b83 20480->20485 20481->20468 20482->20478 20484 7ff784e5b464 __free_lconv_num 11 API calls 20482->20484 20483->20485 20484->20478 20485->20482 20486 7ff784e60b10 _fread_nolock MultiByteToWideChar 20485->20486 20487 7ff784e68bf6 20486->20487 20487->20482 20506 7ff784e60350 20487->20506 20490 7ff784e68c41 20490->20482 20493 7ff784e60350 __crtLCMapStringW 6 API calls 20490->20493 20491 7ff784e68c92 20492 7ff784e5e6c4 _fread_nolock 12 API calls 20491->20492 20494 7ff784e68d64 20491->20494 20495 7ff784e68cb0 20491->20495 20492->20495 20493->20482 20494->20482 20496 7ff784e5b464 __free_lconv_num 11 API calls 20494->20496 20495->20482 20497 7ff784e60350 __crtLCMapStringW 6 API calls 20495->20497 20496->20482 20498 7ff784e68d30 20497->20498 20498->20494 20499 7ff784e68d66 20498->20499 20500 7ff784e68d50 20498->20500 20501 7ff784e61a58 WideCharToMultiByte 20499->20501 20502 7ff784e61a58 WideCharToMultiByte 20500->20502 20503 7ff784e68d5e 20501->20503 20502->20503 20503->20494 20504 7ff784e68d7e 20503->20504 20504->20482 20505 7ff784e5b464 __free_lconv_num 11 API calls 20504->20505 20505->20482 20507 7ff784e5ff7c __crtLCMapStringW 5 API calls 20506->20507 20508 7ff784e6038e 20507->20508 20509 7ff784e60396 20508->20509 20512 7ff784e6043c 20508->20512 20509->20482 20509->20490 20509->20491 20511 7ff784e603ff LCMapStringW 20511->20509 20513 7ff784e5ff7c __crtLCMapStringW 5 API calls 20512->20513 20514 7ff784e6046a __crtLCMapStringW 20513->20514 20514->20511 20517 7ff784e67548 20516->20517 20518 7ff784e67531 20516->20518 20517->20518 20521 7ff784e67556 20517->20521 20519 7ff784e55e48 _get_daylight 11 API calls 20518->20519 20520 7ff784e67536 20519->20520 20522 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20520->20522 20523 7ff784e55e8c 45 API calls 20521->20523 20524 7ff784e67541 20521->20524 20522->20524 20523->20524 20524->20225 20526 7ff784e55e8c 45 API calls 20525->20526 20527 7ff784e6a1e1 20526->20527 20530 7ff784e69e38 20527->20530 20532 7ff784e69e86 20530->20532 20531 7ff784e4bb10 _log10_special 8 API calls 20533 7ff784e68475 20531->20533 20534 7ff784e69f0d 20532->20534 20536 7ff784e69ef8 GetCPInfo 20532->20536 20540 7ff784e69f11 20532->20540 20533->20224 20533->20225 20535 7ff784e60b10 _fread_nolock MultiByteToWideChar 20534->20535 20534->20540 20537 7ff784e69fa5 20535->20537 20536->20534 20536->20540 20538 7ff784e5e6c4 _fread_nolock 12 API calls 20537->20538 20539 7ff784e69fdc 20537->20539 20537->20540 20538->20539 20539->20540 20541 7ff784e60b10 _fread_nolock MultiByteToWideChar 20539->20541 20540->20531 20542 7ff784e6a04a 20541->20542 20543 7ff784e6a12c 20542->20543 20544 7ff784e60b10 _fread_nolock MultiByteToWideChar 20542->20544 20543->20540 20545 7ff784e5b464 __free_lconv_num 11 API calls 20543->20545 20546 7ff784e6a070 20544->20546 20545->20540 20546->20543 20547 7ff784e5e6c4 _fread_nolock 12 API calls 20546->20547 20548 7ff784e6a09d 20546->20548 20547->20548 20548->20543 20549 7ff784e60b10 _fread_nolock MultiByteToWideChar 20548->20549 20550 7ff784e6a114 20549->20550 20551 7ff784e6a11a 20550->20551 20552 7ff784e6a134 20550->20552 20551->20543 20554 7ff784e5b464 __free_lconv_num 11 API calls 20551->20554 20559 7ff784e601d4 20552->20559 20554->20543 20556 7ff784e6a173 20556->20540 20558 7ff784e5b464 __free_lconv_num 11 API calls 20556->20558 20557 7ff784e5b464 __free_lconv_num 11 API calls 20557->20556 20558->20540 20560 7ff784e5ff7c __crtLCMapStringW 5 API calls 20559->20560 20561 7ff784e60212 20560->20561 20562 7ff784e6043c __crtLCMapStringW 5 API calls 20561->20562 20564 7ff784e6021a 20561->20564 20563 7ff784e60283 CompareStringW 20562->20563 20563->20564 20564->20556 20564->20557 20566 7ff784e68eca HeapSize 20565->20566 20567 7ff784e68eb1 20565->20567 20568 7ff784e55e48 _get_daylight 11 API calls 20567->20568 20569 7ff784e68eb6 20568->20569 20570 7ff784e5b824 _invalid_parameter_noinfo 37 API calls 20569->20570 20571 7ff784e68ec1 20570->20571 20571->20230 20573 7ff784e68ef9 20572->20573 20574 7ff784e68f03 20572->20574 20575 7ff784e5e6c4 _fread_nolock 12 API calls 20573->20575 20576 7ff784e68f08 20574->20576 20582 7ff784e68f0f _get_daylight 20574->20582 20580 7ff784e68f01 20575->20580 20577 7ff784e5b464 __free_lconv_num 11 API calls 20576->20577 20577->20580 20578 7ff784e68f15 20581 7ff784e55e48 _get_daylight 11 API calls 20578->20581 20579 7ff784e68f42 HeapReAlloc 20579->20580 20579->20582 20580->20234 20581->20580 20582->20578 20582->20579 20583 7ff784e64800 _get_daylight 2 API calls 20582->20583 20583->20582 20585 7ff784e5ff7c __crtLCMapStringW 5 API calls 20584->20585 20586 7ff784e601b0 20585->20586 20586->20238 20588 7ff784e564b6 20587->20588 20589 7ff784e56492 20587->20589 20590 7ff784e56510 20588->20590 20593 7ff784e564bb 20588->20593 20592 7ff784e5b464 __free_lconv_num 11 API calls 20589->20592 20608 7ff784e564a1 20589->20608 20591 7ff784e60b10 _fread_nolock MultiByteToWideChar 20590->20591 20602 7ff784e5652c 20591->20602 20592->20608 20594 7ff784e564d0 20593->20594 20597 7ff784e5b464 __free_lconv_num 11 API calls 20593->20597 20593->20608 20595 7ff784e5e6c4 _fread_nolock 12 API calls 20594->20595 20595->20608 20596 7ff784e56533 GetLastError 20598 7ff784e55dbc _fread_nolock 11 API calls 20596->20598 20597->20594 20601 7ff784e56540 20598->20601 20599 7ff784e5656e 20600 7ff784e60b10 _fread_nolock MultiByteToWideChar 20599->20600 20599->20608 20605 7ff784e565b2 20600->20605 20606 7ff784e55e48 _get_daylight 11 API calls 20601->20606 20602->20596 20602->20599 20603 7ff784e56561 20602->20603 20607 7ff784e5b464 __free_lconv_num 11 API calls 20602->20607 20604 7ff784e5e6c4 _fread_nolock 12 API calls 20603->20604 20604->20599 20605->20596 20605->20608 20606->20608 20607->20603 20608->20242 20608->20243 20610 7ff784e69da1 __crtLCMapStringW 20609->20610 20611 7ff784e6835e 20610->20611 20612 7ff784e601d4 6 API calls 20610->20612 20611->20297 20611->20298 20612->20611 20613 7ff784e5a899 20614 7ff784e5b358 45 API calls 20613->20614 20615 7ff784e5a89e 20614->20615 20616 7ff784e5a8c5 GetModuleHandleW 20615->20616 20617 7ff784e5a90f 20615->20617 20616->20617 20623 7ff784e5a8d2 20616->20623 20625 7ff784e5a79c 20617->20625 20623->20617 20639 7ff784e5a9c0 GetModuleHandleExW 20623->20639 20645 7ff784e61548 EnterCriticalSection 20625->20645 20640 7ff784e5aa1d 20639->20640 20641 7ff784e5a9f4 GetProcAddress 20639->20641 20643 7ff784e5aa29 20640->20643 20644 7ff784e5aa22 FreeLibrary 20640->20644 20642 7ff784e5aa06 20641->20642 20642->20640 20643->20617 20644->20643 21000 7ff784e62920 21011 7ff784e68654 21000->21011 21013 7ff784e68661 21011->21013 21012 7ff784e5b464 __free_lconv_num 11 API calls 21012->21013 21013->21012 21014 7ff784e6867d 21013->21014 21015 7ff784e5b464 __free_lconv_num 11 API calls 21014->21015 21016 7ff784e62929 21014->21016 21015->21014 21017 7ff784e61548 EnterCriticalSection 21016->21017 20769 7ff784e4b0a0 20770 7ff784e4b0ce 20769->20770 20771 7ff784e4b0b5 20769->20771 20771->20770 20773 7ff784e5e6c4 12 API calls 20771->20773 20772 7ff784e4b12e 20773->20772

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00007FF784E48020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 0 7ff784e48020-7ff784e48166 call 7ff784e4be10 call 7ff784e48950 SetConsoleCtrlHandler GetStartupInfoW call 7ff784e56260 call 7ff784e5b384 call 7ff784e59658 call 7ff784e56260 call 7ff784e5b384 call 7ff784e59658 call 7ff784e56260 call 7ff784e5b384 call 7ff784e59658 GetCommandLineW CreateProcessW 23 7ff784e4818d-7ff784e481c9 RegisterClassW 0->23 24 7ff784e48168-7ff784e48188 GetLastError call 7ff784e42310 0->24 26 7ff784e481cb GetLastError 23->26 27 7ff784e481d1-7ff784e48225 CreateWindowExW 23->27 31 7ff784e48479-7ff784e4849f call 7ff784e4bb10 24->31 26->27 29 7ff784e48227-7ff784e4822d GetLastError 27->29 30 7ff784e4822f-7ff784e48234 ShowWindow 27->30 32 7ff784e4823a-7ff784e4824a WaitForSingleObject 29->32 30->32 34 7ff784e4824c 32->34 35 7ff784e482c8-7ff784e482cf 32->35 39 7ff784e48250-7ff784e48253 34->39 36 7ff784e482d1-7ff784e482e1 WaitForSingleObject 35->36 37 7ff784e48312-7ff784e48319 35->37 40 7ff784e482e7-7ff784e482f7 TerminateProcess 36->40 41 7ff784e48438-7ff784e48442 36->41 42 7ff784e4831f-7ff784e48335 QueryPerformanceFrequency QueryPerformanceCounter 37->42 43 7ff784e48400-7ff784e48419 GetMessageW 37->43 44 7ff784e4825b-7ff784e48262 39->44 45 7ff784e48255 GetLastError 39->45 51 7ff784e482f9 GetLastError 40->51 52 7ff784e482ff-7ff784e4830d WaitForSingleObject 40->52 49 7ff784e48444-7ff784e4844a DestroyWindow 41->49 50 7ff784e48451-7ff784e48475 GetExitCodeProcess CloseHandle * 2 41->50 53 7ff784e48340-7ff784e48378 MsgWaitForMultipleObjects PeekMessageW 42->53 47 7ff784e4841b-7ff784e48429 TranslateMessage DispatchMessageW 43->47 48 7ff784e4842f-7ff784e48436 43->48 44->36 46 7ff784e48264-7ff784e48281 PeekMessageW 44->46 45->44 54 7ff784e48283-7ff784e482b4 TranslateMessage DispatchMessageW PeekMessageW 46->54 55 7ff784e482b6-7ff784e482c6 WaitForSingleObject 46->55 47->48 48->41 48->43 49->50 50->31 51->52 52->41 56 7ff784e4837a 53->56 57 7ff784e483b3-7ff784e483ba 53->57 54->54 54->55 55->35 55->39 58 7ff784e48380-7ff784e483b1 TranslateMessage DispatchMessageW PeekMessageW 56->58 57->43 59 7ff784e483bc-7ff784e483e5 QueryPerformanceCounter 57->59 58->57 58->58 59->53 60 7ff784e483eb-7ff784e483f2 59->60 60->41 61 7ff784e483f4-7ff784e483f8 60->61 61->43
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                      • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                      • API String ID: 4208240515-3165540532
                                                                                                                                                                                                      • Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                                                                                                                                                      • Instruction ID: 07079263e527c2ce5737448bf39f26e97610e90005334543b0a6b5a8b54aa997
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4D18432A08F8296EB10AF76E8906BDB764FF94B58FE00235DA5D42A94DFBCD544C710
                                                                                                                                                                                                      Function 00007FF784E66E70 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 505 7ff784e66e70-7ff784e66eab call 7ff784e667f8 call 7ff784e66800 call 7ff784e66868 512 7ff784e670d5-7ff784e67121 call 7ff784e5b844 call 7ff784e667f8 call 7ff784e66800 call 7ff784e66868 505->512 513 7ff784e66eb1-7ff784e66ebc call 7ff784e66808 505->513 538 7ff784e67127-7ff784e67132 call 7ff784e66808 512->538 539 7ff784e6725f-7ff784e672cd call 7ff784e5b844 call 7ff784e627e8 512->539 513->512 519 7ff784e66ec2-7ff784e66ecc 513->519 520 7ff784e66eee-7ff784e66ef2 519->520 521 7ff784e66ece-7ff784e66ed1 519->521 524 7ff784e66ef5-7ff784e66efd 520->524 523 7ff784e66ed4-7ff784e66edf 521->523 526 7ff784e66eea-7ff784e66eec 523->526 527 7ff784e66ee1-7ff784e66ee8 523->527 524->524 528 7ff784e66eff-7ff784e66f12 call 7ff784e5e6c4 524->528 526->520 530 7ff784e66f1b-7ff784e66f29 526->530 527->523 527->526 535 7ff784e66f2a-7ff784e66f36 call 7ff784e5b464 528->535 536 7ff784e66f14-7ff784e66f16 call 7ff784e5b464 528->536 546 7ff784e66f3d-7ff784e66f45 535->546 536->530 538->539 548 7ff784e67138-7ff784e67143 call 7ff784e66838 538->548 559 7ff784e672db-7ff784e672de 539->559 560 7ff784e672cf-7ff784e672d6 539->560 546->546 549 7ff784e66f47-7ff784e66f58 call 7ff784e616e4 546->549 548->539 557 7ff784e67149-7ff784e6716c call 7ff784e5b464 GetTimeZoneInformation 548->557 549->512 558 7ff784e66f5e-7ff784e66fb4 call 7ff784e6b740 * 4 call 7ff784e66d8c 549->558 572 7ff784e67234-7ff784e6725e call 7ff784e667f0 call 7ff784e667e0 call 7ff784e667e8 557->572 573 7ff784e67172-7ff784e67193 557->573 617 7ff784e66fb6-7ff784e66fba 558->617 562 7ff784e67315-7ff784e67328 call 7ff784e5e6c4 559->562 563 7ff784e672e0 559->563 565 7ff784e6736b-7ff784e6736e 560->565 578 7ff784e6732a 562->578 579 7ff784e67333-7ff784e6734e call 7ff784e627e8 562->579 567 7ff784e672e3 563->567 566 7ff784e67374-7ff784e6737c call 7ff784e66e70 565->566 565->567 574 7ff784e672e8-7ff784e67314 call 7ff784e5b464 call 7ff784e4bb10 566->574 567->574 575 7ff784e672e3 call 7ff784e670ec 567->575 581 7ff784e6719e-7ff784e671a5 573->581 582 7ff784e67195-7ff784e6719b 573->582 575->574 586 7ff784e6732c-7ff784e67331 call 7ff784e5b464 578->586 603 7ff784e67355-7ff784e67367 call 7ff784e5b464 579->603 604 7ff784e67350-7ff784e67353 579->604 588 7ff784e671a7-7ff784e671af 581->588 589 7ff784e671b9 581->589 582->581 586->563 588->589 596 7ff784e671b1-7ff784e671b7 588->596 599 7ff784e671bb-7ff784e6722f call 7ff784e6b740 * 4 call 7ff784e63dcc call 7ff784e67384 * 2 589->599 596->599 599->572 603->565 604->586 619 7ff784e66fbc 617->619 620 7ff784e66fc0-7ff784e66fc4 617->620 619->620 620->617 622 7ff784e66fc6-7ff784e66feb call 7ff784e57b18 620->622 628 7ff784e66fee-7ff784e66ff2 622->628 630 7ff784e66ff4-7ff784e66fff 628->630 631 7ff784e67001-7ff784e67005 628->631 630->631 633 7ff784e67007-7ff784e6700b 630->633 631->628 636 7ff784e6708c-7ff784e67090 633->636 637 7ff784e6700d-7ff784e67035 call 7ff784e57b18 633->637 638 7ff784e67097-7ff784e670a4 636->638 639 7ff784e67092-7ff784e67094 636->639 644 7ff784e67037 637->644 645 7ff784e67053-7ff784e67057 637->645 641 7ff784e670a6-7ff784e670bc call 7ff784e66d8c 638->641 642 7ff784e670bf-7ff784e670ce call 7ff784e667f0 call 7ff784e667e0 638->642 639->638 641->642 642->512 648 7ff784e6703a-7ff784e67041 644->648 645->636 650 7ff784e67059-7ff784e67077 call 7ff784e57b18 645->650 648->645 652 7ff784e67043-7ff784e67051 648->652 657 7ff784e67083-7ff784e6708a 650->657 652->645 652->648 657->636 658 7ff784e67079-7ff784e6707d 657->658 658->636 659 7ff784e6707f 658->659 659->657
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E66EB5
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6681C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF784E5B823,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5B84D
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF784E5B823,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5B872
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E66EA4
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6687C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6711A
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6712B
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6713C
                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF784E6737C), ref: 00007FF784E67163
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                      • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                      • API String ID: 4070488512-239921721
                                                                                                                                                                                                      • Opcode ID: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
                                                                                                                                                                                                      • Instruction ID: 167c66165dd09d9198aa91666655782f9e8bdbf1b279af7cbea08054e5960c28
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1cc6d2bc0113d7e20a77d6be4757883c424c8a6b3909b765b0ec1a4afa43a119
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23D1CF66A1824296EB20FF37D8C01B9E7A1FF94794FE04136EA0D47696DEBCE441C760
                                                                                                                                                                                                      Function 00007FF784E67BD4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 719 7ff784e67bd4-7ff784e67c47 call 7ff784e67908 722 7ff784e67c49-7ff784e67c52 call 7ff784e55e28 719->722 723 7ff784e67c61-7ff784e67c6b call 7ff784e5945c 719->723 728 7ff784e67c55-7ff784e67c5c call 7ff784e55e48 722->728 729 7ff784e67c6d-7ff784e67c84 call 7ff784e55e28 call 7ff784e55e48 723->729 730 7ff784e67c86-7ff784e67cef CreateFileW 723->730 743 7ff784e67fa2-7ff784e67fc2 728->743 729->728 731 7ff784e67d6c-7ff784e67d77 GetFileType 730->731 732 7ff784e67cf1-7ff784e67cf7 730->732 738 7ff784e67dca-7ff784e67dd1 731->738 739 7ff784e67d79-7ff784e67db4 GetLastError call 7ff784e55dbc CloseHandle 731->739 735 7ff784e67d39-7ff784e67d67 GetLastError call 7ff784e55dbc 732->735 736 7ff784e67cf9-7ff784e67cfd 732->736 735->728 736->735 741 7ff784e67cff-7ff784e67d37 CreateFileW 736->741 746 7ff784e67dd9-7ff784e67ddc 738->746 747 7ff784e67dd3-7ff784e67dd7 738->747 739->728 754 7ff784e67dba-7ff784e67dc5 call 7ff784e55e48 739->754 741->731 741->735 748 7ff784e67de2-7ff784e67e37 call 7ff784e59374 746->748 749 7ff784e67dde 746->749 747->748 757 7ff784e67e39-7ff784e67e45 call 7ff784e67b10 748->757 758 7ff784e67e56-7ff784e67e87 call 7ff784e67688 748->758 749->748 754->728 757->758 764 7ff784e67e47 757->764 765 7ff784e67e8d-7ff784e67ecf 758->765 766 7ff784e67e89-7ff784e67e8b 758->766 767 7ff784e67e49-7ff784e67e51 call 7ff784e5b9c8 764->767 768 7ff784e67ef1-7ff784e67efc 765->768 769 7ff784e67ed1-7ff784e67ed5 765->769 766->767 767->743 771 7ff784e67fa0 768->771 772 7ff784e67f02-7ff784e67f06 768->772 769->768 770 7ff784e67ed7-7ff784e67eec 769->770 770->768 771->743 772->771 774 7ff784e67f0c-7ff784e67f51 CloseHandle CreateFileW 772->774 776 7ff784e67f53-7ff784e67f81 GetLastError call 7ff784e55dbc call 7ff784e5959c 774->776 777 7ff784e67f86-7ff784e67f9b 774->777 776->777 777->771
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                                      • Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                                                                                                                                                      • Instruction ID: 061da014ae747a17704f867552f663ac2785a1e9e154cf0241f2d3682e239b64
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E9C10072B28A4695EB10EF66C4C06BC7761FB49BA8FA10239DE2E97394DF78D051C310
                                                                                                                                                                                                      Function 00007FF784E47800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                      • String ID: %s\*
                                                                                                                                                                                                      • API String ID: 1057558799-766152087
                                                                                                                                                                                                      • Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                                                                                                                                                      • Instruction ID: 497e0301f1698f7d6294fb3d9a769f6afd0ade1a7ae9db4c7cca662515a396d9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 87419431A0CD8291EA70BF76E4C42B9A361FB94754FE00632D69D43694DFBCE646C750
                                                                                                                                                                                                      Function 00007FF784E670EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 1040 7ff784e670ec-7ff784e67121 call 7ff784e667f8 call 7ff784e66800 call 7ff784e66868 1047 7ff784e67127-7ff784e67132 call 7ff784e66808 1040->1047 1048 7ff784e6725f-7ff784e672cd call 7ff784e5b844 call 7ff784e627e8 1040->1048 1047->1048 1053 7ff784e67138-7ff784e67143 call 7ff784e66838 1047->1053 1060 7ff784e672db-7ff784e672de 1048->1060 1061 7ff784e672cf-7ff784e672d6 1048->1061 1053->1048 1059 7ff784e67149-7ff784e6716c call 7ff784e5b464 GetTimeZoneInformation 1053->1059 1071 7ff784e67234-7ff784e6725e call 7ff784e667f0 call 7ff784e667e0 call 7ff784e667e8 1059->1071 1072 7ff784e67172-7ff784e67193 1059->1072 1063 7ff784e67315-7ff784e67328 call 7ff784e5e6c4 1060->1063 1064 7ff784e672e0 1060->1064 1065 7ff784e6736b-7ff784e6736e 1061->1065 1076 7ff784e6732a 1063->1076 1077 7ff784e67333-7ff784e6734e call 7ff784e627e8 1063->1077 1067 7ff784e672e3 1064->1067 1066 7ff784e67374-7ff784e6737c call 7ff784e66e70 1065->1066 1065->1067 1073 7ff784e672e8-7ff784e67314 call 7ff784e5b464 call 7ff784e4bb10 1066->1073 1067->1073 1074 7ff784e672e3 call 7ff784e670ec 1067->1074 1079 7ff784e6719e-7ff784e671a5 1072->1079 1080 7ff784e67195-7ff784e6719b 1072->1080 1074->1073 1083 7ff784e6732c-7ff784e67331 call 7ff784e5b464 1076->1083 1098 7ff784e67355-7ff784e67367 call 7ff784e5b464 1077->1098 1099 7ff784e67350-7ff784e67353 1077->1099 1085 7ff784e671a7-7ff784e671af 1079->1085 1086 7ff784e671b9 1079->1086 1080->1079 1083->1064 1085->1086 1092 7ff784e671b1-7ff784e671b7 1085->1092 1094 7ff784e671bb-7ff784e6722f call 7ff784e6b740 * 4 call 7ff784e63dcc call 7ff784e67384 * 2 1086->1094 1092->1094 1094->1071 1098->1065 1099->1083
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6711A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6687C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6712B
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6681C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6713C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6684C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF784E6737C), ref: 00007FF784E67163
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                      • String ID: Eastern Standard Time$Eastern Summer Time
                                                                                                                                                                                                      • API String ID: 3458911817-239921721
                                                                                                                                                                                                      • Opcode ID: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
                                                                                                                                                                                                      • Instruction ID: 39ba1427573d3c933c59519741608881290d0cd92d7ba627972cf178edb01c19
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fce0b41cc66c7972387442f4a259984a91ef9247f86000003104344bdc7b7ed6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6516D72A1864296E720FF23E8C05B9E761BF58784FE04135EA4D47696DFBCE400C760
                                                                                                                                                                                                      Function 00007FF784E48840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                                                      • Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                                                                                                                                                      • Instruction ID: 5a676e4eb874e45ca49a4623d9f23d1476855069a722b01776043709c5f8fd55
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 86F04426A1CA4186F7A09F65B499766B350FB84778FD44335DAAE02AD4DFBCD009CA10
                                                                                                                                                                                                      Function 00007FF784E61B38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1010374628-0
                                                                                                                                                                                                      • Opcode ID: de90d4660cad73c020d10a8b6ecdb18ed9fa62073eb22c4578e43967cc91730a
                                                                                                                                                                                                      • Instruction ID: b71204a8d3da1a01e6052fdef5d4ecc683aeda624f1d70f6c8ecbe19c3f75872
                                                                                                                                                                                                      • Opcode Fuzzy Hash: de90d4660cad73c020d10a8b6ecdb18ed9fa62073eb22c4578e43967cc91730a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5902AE21A0DA4350FE66FF579480279E698BF41B90FF64635DE1E467D2EEBCA401C320
                                                                                                                                                                                                      Function 00007FF784E41000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                      • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                      • API String ID: 2776309574-3325264605
                                                                                                                                                                                                      • Opcode ID: a25986b6cf35e6e96e10b63c61c7e56b41de4d0f9cff64ddf7c996a6741dcc94
                                                                                                                                                                                                      • Instruction ID: a641b1df1ad5fc17ec00e9e9bec43d665ba73469a1f342be55160a47e7f584a1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a25986b6cf35e6e96e10b63c61c7e56b41de4d0f9cff64ddf7c996a6741dcc94
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 83427E21A0CA8291FA25BF33E4D42F9E751BF54780FE44132DA9E426D6EEACE545C370
                                                                                                                                                                                                      Function 00007FF784E41930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 357 7ff784e41930-7ff784e4196b call 7ff784e439d0 360 7ff784e41c2e-7ff784e41c52 call 7ff784e4bb10 357->360 361 7ff784e41971-7ff784e419b1 call 7ff784e473d0 357->361 366 7ff784e419b7-7ff784e419c7 call 7ff784e4fc2c 361->366 367 7ff784e41c1b-7ff784e41c1e call 7ff784e4f5a4 361->367 372 7ff784e419c9-7ff784e419e3 call 7ff784e55e48 call 7ff784e42020 366->372 373 7ff784e419e8-7ff784e41a04 call 7ff784e4f8f4 366->373 371 7ff784e41c23-7ff784e41c2b 367->371 371->360 372->367 379 7ff784e41a06-7ff784e41a20 call 7ff784e55e48 call 7ff784e42020 373->379 380 7ff784e41a25-7ff784e41a3a call 7ff784e55e68 373->380 379->367 387 7ff784e41a3c-7ff784e41a56 call 7ff784e55e48 call 7ff784e42020 380->387 388 7ff784e41a5b-7ff784e41adc call 7ff784e41c60 * 2 call 7ff784e4fc2c 380->388 387->367 399 7ff784e41ae1-7ff784e41af4 call 7ff784e55e84 388->399 402 7ff784e41af6-7ff784e41b10 call 7ff784e55e48 call 7ff784e42020 399->402 403 7ff784e41b15-7ff784e41b2e call 7ff784e4f8f4 399->403 402->367 408 7ff784e41b30-7ff784e41b4a call 7ff784e55e48 call 7ff784e42020 403->408 409 7ff784e41b4f-7ff784e41b6b call 7ff784e4f668 403->409 408->367 417 7ff784e41b7e-7ff784e41b8c 409->417 418 7ff784e41b6d-7ff784e41b79 call 7ff784e41e50 409->418 417->367 419 7ff784e41b92-7ff784e41b99 417->419 418->367 422 7ff784e41ba1-7ff784e41ba7 419->422 424 7ff784e41ba9-7ff784e41bb6 422->424 425 7ff784e41bc0-7ff784e41bcf 422->425 426 7ff784e41bd1-7ff784e41bda 424->426 425->425 425->426 427 7ff784e41bdc-7ff784e41bdf 426->427 428 7ff784e41bef 426->428 427->428 429 7ff784e41be1-7ff784e41be4 427->429 430 7ff784e41bf1-7ff784e41c04 428->430 429->428 431 7ff784e41be6-7ff784e41be9 429->431 432 7ff784e41c0d-7ff784e41c19 430->432 433 7ff784e41c06 430->433 431->428 434 7ff784e41beb-7ff784e41bed 431->434 432->367 432->422 433->432 434->430
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E473D0: _fread_nolock.LIBCMT ref: 00007FF784E4747A
                                                                                                                                                                                                      • _fread_nolock.LIBCMT ref: 00007FF784E419FB
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF784E41B4A), ref: 00007FF784E42070
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                      • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2397952137-3497178890
                                                                                                                                                                                                      • Opcode ID: 0fcfd04c0a680d836935c9f28b1a1ce0c09f4c09d7b9dd9514b081b0fbca326a
                                                                                                                                                                                                      • Instruction ID: dcda2c30f0a3d87267a18805eea835f09dc8401e6758e2e25097fa9ed8861706
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0fcfd04c0a680d836935c9f28b1a1ce0c09f4c09d7b9dd9514b081b0fbca326a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B818F31A0CA8695EB10EF26D4C46B9E3A1FF88784FE44036D98D47789DEBCE545CB60
                                                                                                                                                                                                      Function 00007FF784E415E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 435 7ff784e415e0-7ff784e415f1 436 7ff784e41617-7ff784e41631 call 7ff784e439d0 435->436 437 7ff784e415f3-7ff784e415fc call 7ff784e41030 435->437 444 7ff784e41662-7ff784e4167c call 7ff784e439d0 436->444 445 7ff784e41633-7ff784e41661 call 7ff784e55e48 call 7ff784e42020 436->445 442 7ff784e4160e-7ff784e41616 437->442 443 7ff784e415fe-7ff784e41609 call 7ff784e41e50 437->443 443->442 451 7ff784e41698-7ff784e416af call 7ff784e4fc2c 444->451 452 7ff784e4167e-7ff784e41693 call 7ff784e41e50 444->452 460 7ff784e416d9-7ff784e416dd 451->460 461 7ff784e416b1-7ff784e416d4 call 7ff784e55e48 call 7ff784e42020 451->461 459 7ff784e41801-7ff784e41804 call 7ff784e4f5a4 452->459 468 7ff784e41809-7ff784e4181b 459->468 462 7ff784e416f7-7ff784e41717 call 7ff784e55e84 460->462 463 7ff784e416df-7ff784e416eb call 7ff784e411f0 460->463 473 7ff784e417f9-7ff784e417fc call 7ff784e4f5a4 461->473 474 7ff784e41719-7ff784e4173c call 7ff784e55e48 call 7ff784e42020 462->474 475 7ff784e41741-7ff784e4174c 462->475 470 7ff784e416f0-7ff784e416f2 463->470 470->473 473->459 487 7ff784e417ef-7ff784e417f4 474->487 479 7ff784e417e2-7ff784e417ea call 7ff784e55e70 475->479 480 7ff784e41752-7ff784e41757 475->480 479->487 483 7ff784e41760-7ff784e41782 call 7ff784e4f8f4 480->483 490 7ff784e417ba-7ff784e417c6 call 7ff784e55e48 483->490 491 7ff784e41784-7ff784e4179c call 7ff784e50034 483->491 487->473 498 7ff784e417cd-7ff784e417d8 call 7ff784e42020 490->498 496 7ff784e4179e-7ff784e417a1 491->496 497 7ff784e417a5-7ff784e417b8 call 7ff784e55e48 491->497 496->483 499 7ff784e417a3 496->499 497->498 502 7ff784e417dd 498->502 499->502 502->479
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-1550345328
                                                                                                                                                                                                      • Opcode ID: c306875021d272c5ba8de04f5c43888d0ac3fc001306e33a58653c900e66abc9
                                                                                                                                                                                                      • Instruction ID: 224ddbf74b104bc640be47c58ff5372aa3e3a6e00a90a7114a1f7b84ec45a1ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c306875021d272c5ba8de04f5c43888d0ac3fc001306e33a58653c900e66abc9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1519D21B0CA8792EA10BF23A4945B9E390BF44B94FE44532EE4C47B96DEBCF545C720
                                                                                                                                                                                                      Function 00007FF784E47CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF784E43101), ref: 00007FF784E47D44
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00007FF784E43101), ref: 00007FF784E47D4A
                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(?,00007FF784E43101), ref: 00007FF784E47D8C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47E70: GetEnvironmentVariableW.KERNEL32(00007FF784E42C4F), ref: 00007FF784E47EA7
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF784E47EC9
                                                                                                                                                                                                        • Part of subcall function 00007FF784E59174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E5918D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                      • API String ID: 365913792-1339014028
                                                                                                                                                                                                      • Opcode ID: 93349d7b9616cd7418fb1fb7d836f55c0d98c0562c0ac1a5b6313c198f173f9d
                                                                                                                                                                                                      • Instruction ID: e23c315129d5401b667c29b37c96fab67ea3ad66f106b9c050ae5632edd88735
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 93349d7b9616cd7418fb1fb7d836f55c0d98c0562c0ac1a5b6313c198f173f9d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9418C21A29A8250EA60FF3399D52F9E351BF857C0FE11132ED0D47696DEBCE501C660
                                                                                                                                                                                                      Function 00007FF784E411F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 782 7ff784e411f0-7ff784e4124d call 7ff784e4b340 785 7ff784e41277-7ff784e4128f call 7ff784e55e84 782->785 786 7ff784e4124f-7ff784e41276 call 7ff784e41e50 782->786 791 7ff784e41291-7ff784e412af call 7ff784e55e48 call 7ff784e42020 785->791 792 7ff784e412b4-7ff784e412c4 call 7ff784e55e84 785->792 805 7ff784e41419-7ff784e4142e call 7ff784e4b020 call 7ff784e55e70 * 2 791->805 798 7ff784e412e9-7ff784e412fb 792->798 799 7ff784e412c6-7ff784e412e4 call 7ff784e55e48 call 7ff784e42020 792->799 801 7ff784e41300-7ff784e41325 call 7ff784e4f8f4 798->801 799->805 811 7ff784e4132b-7ff784e41335 call 7ff784e4f668 801->811 812 7ff784e41411 801->812 819 7ff784e41433-7ff784e4144d 805->819 811->812 818 7ff784e4133b-7ff784e41347 811->818 812->805 820 7ff784e41350-7ff784e41378 call 7ff784e49780 818->820 823 7ff784e4137a-7ff784e4137d 820->823 824 7ff784e413f6-7ff784e4140c call 7ff784e41e50 820->824 825 7ff784e413f1 823->825 826 7ff784e4137f-7ff784e41389 823->826 824->812 825->824 828 7ff784e4138b-7ff784e41399 call 7ff784e50034 826->828 829 7ff784e413b4-7ff784e413b7 826->829 833 7ff784e4139e-7ff784e413a1 828->833 831 7ff784e413ca-7ff784e413cf 829->831 832 7ff784e413b9-7ff784e413c7 call 7ff784e6b0a0 829->832 831->820 835 7ff784e413d5-7ff784e413d8 831->835 832->831 836 7ff784e413af-7ff784e413b2 833->836 837 7ff784e413a3-7ff784e413ad call 7ff784e4f668 833->837 839 7ff784e413da-7ff784e413dd 835->839 840 7ff784e413ec-7ff784e413ef 835->840 836->824 837->831 837->836 839->824 842 7ff784e413df-7ff784e413e7 839->842 840->812 842->801
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-2813020118
                                                                                                                                                                                                      • Opcode ID: e91fb656f9fee3107f0b202a40836b7f8723847869dc488222caa63f2af3d13a
                                                                                                                                                                                                      • Instruction ID: a23eff31c570ac3d538640844f82200504e93707fb086efb53c9211f20551f3a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e91fb656f9fee3107f0b202a40836b7f8723847869dc488222caa63f2af3d13a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6151B622A08A8245EA60BF23A4843BAE391FF84794FE44535ED8D477D5EFBCE505C720
                                                                                                                                                                                                      Function 00007FF784E5FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF784E60316,?,?,-00000018,00007FF784E5BC5B,?,?,?,00007FF784E5BB52,?,?,?,00007FF784E56EFE), ref: 00007FF784E600F8
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF784E60316,?,?,-00000018,00007FF784E5BC5B,?,?,?,00007FF784E5BB52,?,?,?,00007FF784E56EFE), ref: 00007FF784E60104
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                                      • Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                                                                                                                                                      • Instruction ID: 050010227f9f65227f984e52725a379e2fc910b4dd1ea93dd5ff19582a2f0b35
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6415621B19A5251FA91EF27E880675A391BF08BA4FA54935CD0D87784FFFDE445C320
                                                                                                                                                                                                      Function 00007FF784E42A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,00007FF784E42BC5), ref: 00007FF784E42AA1
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E42BC5), ref: 00007FF784E42AAB
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E42360
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E4241A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
                                                                                                                                                                                                      • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                      • API String ID: 4002088556-2863816727
                                                                                                                                                                                                      • Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                                                                                                                                                      • Instruction ID: 37300d5d1d5eec170fd686da0764ca893e93483198482771c54cfde83af6e54a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E217421B1CE4291FA60BF36E8943B6E351BF98394FE04132E54D865D5EEACE505C720
                                                                                                                                                                                                      Function 00007FF784E5C95C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 927 7ff784e5c95c-7ff784e5c982 928 7ff784e5c99d-7ff784e5c9a1 927->928 929 7ff784e5c984-7ff784e5c998 call 7ff784e55e28 call 7ff784e55e48 927->929 931 7ff784e5cd77-7ff784e5cd83 call 7ff784e55e28 call 7ff784e55e48 928->931 932 7ff784e5c9a7-7ff784e5c9ae 928->932 943 7ff784e5cd8e 929->943 950 7ff784e5cd89 call 7ff784e5b824 931->950 932->931 934 7ff784e5c9b4-7ff784e5c9e2 932->934 934->931 937 7ff784e5c9e8-7ff784e5c9ef 934->937 940 7ff784e5ca08-7ff784e5ca0b 937->940 941 7ff784e5c9f1-7ff784e5ca03 call 7ff784e55e28 call 7ff784e55e48 937->941 946 7ff784e5cd73-7ff784e5cd75 940->946 947 7ff784e5ca11-7ff784e5ca17 940->947 941->950 948 7ff784e5cd91-7ff784e5cda8 943->948 946->948 947->946 951 7ff784e5ca1d-7ff784e5ca20 947->951 950->943 951->941 952 7ff784e5ca22-7ff784e5ca47 951->952 955 7ff784e5ca7a-7ff784e5ca81 952->955 956 7ff784e5ca49-7ff784e5ca4b 952->956 960 7ff784e5ca83-7ff784e5caab call 7ff784e5e6c4 call 7ff784e5b464 * 2 955->960 961 7ff784e5ca56-7ff784e5ca6d call 7ff784e55e28 call 7ff784e55e48 call 7ff784e5b824 955->961 958 7ff784e5ca4d-7ff784e5ca54 956->958 959 7ff784e5ca72-7ff784e5ca78 956->959 958->959 958->961 963 7ff784e5caf8-7ff784e5cb0f 959->963 988 7ff784e5caad-7ff784e5cac3 call 7ff784e55e48 call 7ff784e55e28 960->988 989 7ff784e5cac8-7ff784e5caf3 call 7ff784e5d184 960->989 992 7ff784e5cc00 961->992 966 7ff784e5cb8a-7ff784e5cb94 call 7ff784e64b8c 963->966 967 7ff784e5cb11-7ff784e5cb19 963->967 979 7ff784e5cc1e 966->979 980 7ff784e5cb9a-7ff784e5cbaf 966->980 967->966 971 7ff784e5cb1b-7ff784e5cb1d 967->971 971->966 976 7ff784e5cb1f-7ff784e5cb35 971->976 976->966 981 7ff784e5cb37-7ff784e5cb43 976->981 984 7ff784e5cc23-7ff784e5cc43 ReadFile 979->984 980->979 986 7ff784e5cbb1-7ff784e5cbc3 GetConsoleMode 980->986 981->966 982 7ff784e5cb45-7ff784e5cb47 981->982 982->966 987 7ff784e5cb49-7ff784e5cb61 982->987 990 7ff784e5cd3d-7ff784e5cd46 GetLastError 984->990 991 7ff784e5cc49-7ff784e5cc51 984->991 986->979 993 7ff784e5cbc5-7ff784e5cbcd 986->993 987->966 995 7ff784e5cb63-7ff784e5cb6f 987->995 988->992 989->963 1000 7ff784e5cd48-7ff784e5cd5e call 7ff784e55e48 call 7ff784e55e28 990->1000 1001 7ff784e5cd63-7ff784e5cd66 990->1001 991->990 997 7ff784e5cc57 991->997 994 7ff784e5cc03-7ff784e5cc0d call 7ff784e5b464 992->994 993->984 999 7ff784e5cbcf-7ff784e5cbf1 ReadConsoleW 993->999 994->948 995->966 1003 7ff784e5cb71-7ff784e5cb73 995->1003 1007 7ff784e5cc5e-7ff784e5cc73 997->1007 1009 7ff784e5cbf3 GetLastError 999->1009 1010 7ff784e5cc12-7ff784e5cc1c 999->1010 1000->992 1004 7ff784e5cd6c-7ff784e5cd6e 1001->1004 1005 7ff784e5cbf9-7ff784e5cbfb call 7ff784e55dbc 1001->1005 1003->966 1014 7ff784e5cb75-7ff784e5cb85 1003->1014 1004->994 1005->992 1007->994 1016 7ff784e5cc75-7ff784e5cc80 1007->1016 1009->1005 1010->1007 1014->966 1020 7ff784e5cca7-7ff784e5ccaf 1016->1020 1021 7ff784e5cc82-7ff784e5cc9b call 7ff784e5c574 1016->1021 1024 7ff784e5cd2b-7ff784e5cd38 call 7ff784e5c3b4 1020->1024 1025 7ff784e5ccb1-7ff784e5ccc3 1020->1025 1027 7ff784e5cca0-7ff784e5cca2 1021->1027 1024->1027 1028 7ff784e5cd1e-7ff784e5cd26 1025->1028 1029 7ff784e5ccc5 1025->1029 1027->994 1028->994 1030 7ff784e5ccca-7ff784e5ccd1 1029->1030 1032 7ff784e5cd0d-7ff784e5cd18 1030->1032 1033 7ff784e5ccd3-7ff784e5ccd7 1030->1033 1032->1028 1034 7ff784e5ccd9-7ff784e5cce0 1033->1034 1035 7ff784e5ccf3 1033->1035 1034->1035 1036 7ff784e5cce2-7ff784e5cce6 1034->1036 1037 7ff784e5ccf9-7ff784e5cd09 1035->1037 1036->1035 1038 7ff784e5cce8-7ff784e5ccf1 1036->1038 1037->1030 1039 7ff784e5cd0b 1037->1039 1038->1037 1039->1028
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: e215fe86d7b0e6e2d08488d11c6944312657e99f94033e5188670243fcaba875
                                                                                                                                                                                                      • Instruction ID: 01dc999b3a83e23055f5ac2cabf3fdf54dd7af1185050d0cfef494fc788c7d7d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e215fe86d7b0e6e2d08488d11c6944312657e99f94033e5188670243fcaba875
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FC1E43290CB8691E761AF1694D02BDEBA0FB81B90FE64131DA4E87795DEFCE445C720
                                                                                                                                                                                                      Function 00007FF784E47BB0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 995526605-0
                                                                                                                                                                                                      • Opcode ID: cf92fa18b9e00c3d9d6dbbac75613ba75212e4a615f40cb6368d246a710d7e34
                                                                                                                                                                                                      • Instruction ID: 2439c2519a471b4c1c00dba6e3d7bd65f94108691d540a0660ae97621f6affe3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf92fa18b9e00c3d9d6dbbac75613ba75212e4a615f40cb6368d246a710d7e34
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D1210531A0CE4241EA50AF66B4C452AE7A1FB857A0FA40235D69D43AE4DEFCD445C750
                                                                                                                                                                                                      Function 00007FF784E485C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetCurrentProcess.KERNEL32 ref: 00007FF784E47BD0
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: OpenProcessToken.ADVAPI32 ref: 00007FF784E47BE3
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetTokenInformation.KERNELBASE ref: 00007FF784E47C08
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetLastError.KERNEL32 ref: 00007FF784E47C12
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetTokenInformation.KERNELBASE ref: 00007FF784E47C52
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF784E47C6E
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: CloseHandle.KERNEL32 ref: 00007FF784E47C86
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00007FF784E43099), ref: 00007FF784E4864C
                                                                                                                                                                                                      • LocalFree.KERNEL32 ref: 00007FF784E48655
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                      • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                      • API String ID: 6828938-1529539262
                                                                                                                                                                                                      • Opcode ID: f56e2b7b13e58d2b58346e81af7f984cd6ebbcb2f1baaaba9af8eb6cf4aaa322
                                                                                                                                                                                                      • Instruction ID: ad025503cb6a7b923866dc14a6c3371c6c96c4c5cffe3c659115aa5f9b43da03
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f56e2b7b13e58d2b58346e81af7f984cd6ebbcb2f1baaaba9af8eb6cf4aaa322
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24215121A08A8291F650BF22E5953EAF351FB94780FE44435EA4D43B96DFBCD544C760
                                                                                                                                                                                                      Function 00007FF784E47260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(00000000,?,00007FF784E428EC,FFFFFFFF,00000000,00007FF784E4336A), ref: 00007FF784E47372
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectory
                                                                                                                                                                                                      • String ID: %.*s$%s%c$\
                                                                                                                                                                                                      • API String ID: 4241100979-1685191245
                                                                                                                                                                                                      • Opcode ID: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
                                                                                                                                                                                                      • Instruction ID: ec7e009bba68ff033b09c4af82a6298c6f8d4e0aa3f8672764dee35fc0233869
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8483aebf73e132e5a1e11bd86e0dae461c6ec9d36d7fd58fe1f5dbf943300de9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8731F861719EC555EA21AF32E4903BAA354FB84BE0FA00631EEAD43BC9DE6CD605C710
                                                                                                                                                                                                      Function 00007FF784E5DE60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E5DE4B), ref: 00007FF784E5DF7C
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E5DE4B), ref: 00007FF784E5E007
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                                      • Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                                                                                                                                                      • Instruction ID: 251a3bfaea5929ed6120b422c8ef9e6401220a7972c3b6d5c98bca3598b91dd2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E691F732F1865185F750AF6A94C16BDABA0BB04B88FB54139DE4E97B84DFBCE441C320
                                                                                                                                                                                                      Function 00007FF784E60BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_isindst
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4170891091-0
                                                                                                                                                                                                      • Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                                                                                                                                                      • Instruction ID: 890672db28e4864a3198b0733a5666144d9e1a36d48fee072c3ba6288e145e33
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5751F772F042219BEB14EF25D9D56BCA765BB10358FA00235DE2E92AE5EF78A441C710
                                                                                                                                                                                                      Function 00007FF784E56738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2780335769-0
                                                                                                                                                                                                      • Opcode ID: ae309e55c8ec1c6071936a6282bf89ed613bd6d0468dcdab4ccc506c416e71eb
                                                                                                                                                                                                      • Instruction ID: f8f4f25b11723a4a98c41509062594c7ec1a4c95c387c3008f9309e63ce02e78
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ae309e55c8ec1c6071936a6282bf89ed613bd6d0468dcdab4ccc506c416e71eb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1951A122E086018AF710EF72D4803BDA3A1FF48B98FA54534DE0D87699DFB8D491C360
                                                                                                                                                                                                      Function 00007FF784E565E4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279662727-0
                                                                                                                                                                                                      • Opcode ID: 6ce4c88b6d2478032947ca8abe21e63121e2028da5231a2800b2a2486ebac064
                                                                                                                                                                                                      • Instruction ID: 6fe7c9c3453b7ede9958a06030b97ba378c9b75960c5f1eb8104c43334d1f32f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6ce4c88b6d2478032947ca8abe21e63121e2028da5231a2800b2a2486ebac064
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3741A222E1878283E754AF329590379B360FB95364F619734E69C43AD5DFECA1E0C720
                                                                                                                                                                                                      Function 00007FF784E5A968 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
                                                                                                                                                                                                      • Instruction ID: bcf24dd4a92d90551637ab0fad22a5916be03a756117c4e8e7dd7f8b6f8fa5e4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01D09E10B0C71257EA243FB26CD567992517F98711FE21538C88F86397CDEDA449CA60
                                                                                                                                                                                                      Function 00007FF784E4F694 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
                                                                                                                                                                                                      • Instruction ID: 76b8dc6642fdf21747f57a59fe8c5112ecd9f63f7a7e2649cf60a3844d6c905d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A51C521B09A8546E664BE37948067AE391BF48FB4FA44734DE6C477D5CEBCE400C620
                                                                                                                                                                                                      Function 00007FF784E4C1FC Relevance: 3.1, APIs: 2, Instructions: 102COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1236291503-0
                                                                                                                                                                                                      • Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                                                                                                                                                      • Instruction ID: efa1afa077954c403d8534aabe0eb939e0cc1bbc0ca44bd00f397928e549857a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A316C11E0CA4242FA64BF7795913B99391BF84784FE65035E94D876D7DEECB804C234
                                                                                                                                                                                                      Function 00007FF784E5D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileHandleType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3000768030-0
                                                                                                                                                                                                      • Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                                                                                                                                                      • Instruction ID: 41b1d0d5b4994015d1a68934c93fcb548392e5e0c67a07b281a2085a95f9a834
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 21319521A18B4691EB60AF1685C057DA650FB45BB0FB55339DBAE873E0CF7CE461D310
                                                                                                                                                                                                      Function 00007FF784E5D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF784E5D020,?,?,?,?,?,00007FF784E5D129), ref: 00007FF784E5D080
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00007FF784E5D020,?,?,?,?,?,00007FF784E5D129), ref: 00007FF784E5D08A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2976181284-0
                                                                                                                                                                                                      • Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                                                                                                                                                      • Instruction ID: 0977229599fade3dbd9181320dcf17940316df172bcdf2ad084e2b1e35ae5835
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6411C461608B8181DA10AF26B484069E762FB44FF4FA44331EEBD8B7E9DEBCD055C754
                                                                                                                                                                                                      Function 00007FF784E568E0 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E567F5), ref: 00007FF784E56913
                                                                                                                                                                                                      • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E567F5), ref: 00007FF784E56929
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1707611234-0
                                                                                                                                                                                                      • Opcode ID: 2039fd83e8b56068fe4c14b51341d05702151df0dd8c41e9036d506d0e0dfe63
                                                                                                                                                                                                      • Instruction ID: bc6a8ba5c34b3d8e9aaf60b066359988a5f997f958182268b5da6d1659ea04a0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2039fd83e8b56068fe4c14b51341d05702151df0dd8c41e9036d506d0e0dfe63
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8311913160C65381EB54AF22A49103AF7A0FB81771FB0023AF6AD819D8EFBCD004CB20
                                                                                                                                                                                                      Function 00007FF784E5B464 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 485612231-0
                                                                                                                                                                                                      • Opcode ID: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                                                                                                                                                      • Instruction ID: 4d859fde1128efcbdee5a7978eaca840a8a66571161b7e4bbd5699afef145c7a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 58E08C51F0CA0686FF297FF3A8C4038D1617F98740FE14034CA0D86262EEAC6885C330
                                                                                                                                                                                                      Function 00007FF784E5BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CloseHandle.KERNELBASE(?,?,?,00007FF784E5B8DD,?,?,00000000,00007FF784E5B992), ref: 00007FF784E5BACE
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E5B8DD,?,?,00000000,00007FF784E5B992), ref: 00007FF784E5BAD8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseErrorHandleLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 918212764-0
                                                                                                                                                                                                      • Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                                                                                                                                                      • Instruction ID: 1e5ebbbbf8fc829e3d94d43c4f20d7f47d3bde2fb587b86a9ea32fb3b24dec37
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A21A720B0C68245FE507F23A5D02BD92817F547A4FE64235EA6EC77C6DEECA445C320
                                                                                                                                                                                                      Function 00007FF784E5CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                                                                                                                                                      • Instruction ID: 976e9cb1c4115ad619679ef7eaa818e8ce680f78774be671e167e1e23b41faeb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf3d959f73a155a0d737dce44897d7a2acb78217b54b69b3c35a670fde34ce7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B41B13290824587EA24AF1AE59027DF7A0FB59B44FA11131DA8EC7A91CFBDE402D761
                                                                                                                                                                                                      Function 00007FF784E473D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _fread_nolock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 840049012-0
                                                                                                                                                                                                      • Opcode ID: 9c1d627a8e0da694425adc2190c14688c2d453bfb0cb97a760314b616e1d52a5
                                                                                                                                                                                                      • Instruction ID: f6055b1e5cdafaea44dc165fee330da226b4745cd0468ea1622b76e908e1ea3e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c1d627a8e0da694425adc2190c14688c2d453bfb0cb97a760314b616e1d52a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37218021B08A9245EA10BE2365843BADB41BF45BD8FE94430EE4D4B786CEBCE042C360
                                                                                                                                                                                                      Function 00007FF784E5C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
                                                                                                                                                                                                      • Instruction ID: 55a7e646a259de535d4e7aff44001ab53320c48cbd037f57319552c34b713158
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC316932A1CA4685F6117F5698D13BCA690BF44BA4FE20135EA2D873D2DEFCA441C771
                                                                                                                                                                                                      Function 00007FF784E5A899 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3947729631-0
                                                                                                                                                                                                      • Opcode ID: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
                                                                                                                                                                                                      • Instruction ID: 37e9a087edecc467e6f2d1d0b5401eea29b585735f6ec77c68a2d0043c7ca011
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6721B232E047158AEB24AFA5D4802FC73A0FB04318FA60635D76D87AC5EFB8D644C760
                                                                                                                                                                                                      Function 00007FF784E56F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                                                                                                                                                      • Instruction ID: 5e8ef822cc53a71ce1638ff2d8650fc1b96608f4ba932b2d7003fb61fb48c4f6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23118722A1D64181EA61BF63D48027DE360BF55B80FE64031EB4C97B9ACFBCD551C760
                                                                                                                                                                                                      Function 00007FF784E675C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                                                                                                                                                      • Instruction ID: cbd2afd20367d0553b0c76f85b917752e8ef6687b5ede25ca922c17e5a19890a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EF219572A18A8297DB61AF19D4C0379B6A1FB84B94FB44234E65D876D9DF7CD400CB10
                                                                                                                                                                                                      Function 00007FF784E4F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                                                                                                                                                      • Instruction ID: 81a08b3300cd5d92c1ce8069e820b19ce5e27cd8ef565af115525640cd6a2347
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C01A121A08B4240EA04AFA39840079E794BF95FE4FA84631DF6C57BDADEBCE401C310
                                                                                                                                                                                                      Function 00007FF784E58E38 Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
                                                                                                                                                                                                      • Instruction ID: dddaa37b720994450b8545b7d32a9080f62bcf9f661e1fac7cbed9587b98040a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1708b530f5072f472fe09baedec27f5756de37f3e343805e4a7815c0544b33da
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E7015B20E0D64240FE61BF6769C1279D1A4BF00790FB64635EA6DD27D6DFBCA461C220
                                                                                                                                                                                                      Function 00007FF784E59174 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
                                                                                                                                                                                                      • Instruction ID: 4389648de0b4653a8fea86df08456091f5465105e7473dccc28414328fed399a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca4321753697ca9e26add91f4c87d6fa1af88743aafd66e8485bee4c71de2195
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76E0EC61E086178BF7153EE246C61B8D1507F18344FF76074DA188A2C3DD9D6C55D732
                                                                                                                                                                                                      Function 00007FF784E4C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF784E4C3F0
                                                                                                                                                                                                        • Part of subcall function 00007FF784E4CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF784E4CE20
                                                                                                                                                                                                        • Part of subcall function 00007FF784E4CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF784E4CE25
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1208906642-0
                                                                                                                                                                                                      • Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                                                                                                                                                      • Instruction ID: 477f747081680ce65938f5a43f402049da3be257f50f22ee7caa2dff1b37617d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8E09210D0DA4285FE643E7315C62B987407F29348FF214B4D94DA3187EECD3556E132
                                                                                                                                                                                                      Function 00007FF784E5FE04 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapAlloc.KERNEL32(?,?,00000000,00007FF784E5C22A,?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392), ref: 00007FF784E5FE59
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4292702814-0
                                                                                                                                                                                                      • Opcode ID: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                                                                                                                                                      • Instruction ID: 440a3c639636c4b2fdb5c13bed7941c08430d41118a690a59d2d525864479ad8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e5baedaef9e1aefb999d7e678a491e2cb8f7af630fb86e3f47b81283e20e243b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EDF06D51B5924B85FE557FA3A9953B4D2907F49BA0FE94630C90ECA3C2EE9CE581C230
                                                                                                                                                                                                      Function 00007FF784E5E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapAlloc.KERNEL32(?,?,?,00007FF784E50268,?,?,?,00007FF784E518D2,?,?,?,?,?,00007FF784E54595), ref: 00007FF784E5E702
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4292702814-0
                                                                                                                                                                                                      • Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                                                                                                                                                      • Instruction ID: ce0a128bb3ee3c9e3326de9eddd4c58ba98e077302ca3d18c7da1719007fdb20
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07F05811A1C24641FE683FA75982279D2807F54BA0FEA0630E92EC62C1EEECA480C630

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00007FF784E46B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorLastProc
                                                                                                                                                                                                      • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                      • API String ID: 199729137-3427451314
                                                                                                                                                                                                      • Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                                                                                                                                                      • Instruction ID: fd6ed9d898bb06d77fdc5fc1f9b5c5a551aa18d20b2c12d86805d82f09595b92
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2102A264A0DF47A0FA55BF67B8D45B4A3A2BF08745FF41136C84E062A5EFBCA549C230
                                                                                                                                                                                                      Function 00007FF784E6531C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                      • API String ID: 808467561-2761157908
                                                                                                                                                                                                      • Opcode ID: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
                                                                                                                                                                                                      • Instruction ID: c5200f51e89411186a1569ff9290ae865ffab96fcd85139734b55ecc6baaaadc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d700f69ad9a83803b0d0e637264b1b7e22121a30603610bb88393cfb8a3bc4ed
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 55B21972F182969BE7649F36E4807FDF7A1FB54388FA01135DA0E57A84DBB8A500CB50
                                                                                                                                                                                                      Function 00007FF784E4A26D Relevance: 12.0, Strings: 9, Instructions: 744COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid code lengths set$invalid distance code$invalid distance too far back$invalid distances set$invalid literal/length code$invalid literal/lengths set$too many length or distance symbols
                                                                                                                                                                                                      • API String ID: 0-2665694366
                                                                                                                                                                                                      • Opcode ID: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
                                                                                                                                                                                                      • Instruction ID: 26f0a04942826f696824bf2d2a5099716fa640547e43d6455d6bee20e7e2e2f7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4827148dd37d06b9a23a2cb7d22b3f776e5342dd5831b168843cb21776e0705c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3D521772A14BA58BE7A49F26C488B7E7BADFB84310F514139E64A977C0DB7CD840CB10
                                                                                                                                                                                                      Function 00007FF784E4C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                                      • Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                                                                                                                                                      • Instruction ID: 9586e9e8619aedb7928a363e3b39e48c39d9a86087b491d66dda1200b3ef9b9d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51314372609B8196EB60AF61E8807EDB364FB84744F94413ADA8D47B94DFB8D548C720
                                                                                                                                                                                                      Function 00007FF784E5B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                                      • Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                                                                                                                                                      • Instruction ID: 99962375f9e4bb9e1d7dd6f498e3d83d3a32419b60a96cfec58af3daf0b89080
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3731B832608F8196DB60DF26E8807ADB3A4FB98754FA00535EA9D43B54DFBCD145CB10
                                                                                                                                                                                                      Function 00007FF784E62AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2227656907-0
                                                                                                                                                                                                      • Opcode ID: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
                                                                                                                                                                                                      • Instruction ID: 94b1b93f16478aabcac2d51ff9c99aa84dcc9c6c2f93d6fb0a3505e875f11a8d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ccac9e585c27fa031d1f88e05c20b38684cf4203d2ca8c6846fc05bcbc68a6e8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 45B1D522B1869251EE61BF23D8802B9E361FB54BE4FA45132EE5E47BD5DEBCE441C310
                                                                                                                                                                                                      Function 00007FF784E4C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                      • Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                                                                                                                                                      • Instruction ID: e134854c2d7808d327d19b44f4b735758ac9ad905074b2bc38b8f7a22f84d7c3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67113022B18F059AEB00EF61E8942B873A4FB19758F941E31DA6D467A4DFBCD154C350
                                                                                                                                                                                                      Function 00007FF784E64E80 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: memcpy_s
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1502251526-0
                                                                                                                                                                                                      • Opcode ID: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                      • Instruction ID: 606407285cfa16f8190f4f97dafec96d11b8725cd9dc6fa10ef7b95010f33fcc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b41cb84a548d2e61bdeb7bb10330278f5fecde395d7a0ce6ff99175555b28b3c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1AC11672B1868A97EB24DF1AB08467AF7A1F784B84F949134DB4E47B44DB7DE800CB40
                                                                                                                                                                                                      Function 00007FF784E49A34 Relevance: 4.1, Strings: 3, Instructions: 398COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: $header crc mismatch$unknown header flags set
                                                                                                                                                                                                      • API String ID: 0-1127688429
                                                                                                                                                                                                      • Opcode ID: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
                                                                                                                                                                                                      • Instruction ID: 76e58eea9af388d2d8d789977e0a498a9c769c9692e34c30b44f3f49daed0fdc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4bf022b898153f2a381bcd878a50a5d3c06b36ca84da26d2d0edcb3d1e551c0
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 65F1C572A18BC54BE7A5AF36C0C8A3ABBE9FF44744F654538DA4927390CBB8D940C750
                                                                                                                                                                                                      Function 00007FF784E6A998 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 15204871-0
                                                                                                                                                                                                      • Opcode ID: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
                                                                                                                                                                                                      • Instruction ID: 091bee6fd6c279b14a9beef6f4197a3a76671916a4c4aacaed07d1fc609021be
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e29282b711dd5704c0e64fe7638cddbeeb7149a3015151b68882fd3146651568
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7AB1A273A04B888BE725DF2AC48636DBBE0F785B48F248926DB5D837A4CB79D451C710
                                                                                                                                                                                                      Function 00007FF784E54450 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: $
                                                                                                                                                                                                      • API String ID: 0-227171996
                                                                                                                                                                                                      • Opcode ID: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
                                                                                                                                                                                                      • Instruction ID: 3e8f1cfa0fcf292ea8bab4a191b09da7c54ae3236a34d43e66a5a4fd6452ebe1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5ebab5a2817f928350dc9776a3da4b540f16bc97e78530f340af468d76ff9f5e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97E1B872E0864681EB68AF2680D037DB3A0FF45B48FB64135DA4E87B94DFB9E851C750
                                                                                                                                                                                                      Function 00007FF784E4989B Relevance: 2.7, Strings: 2, Instructions: 216COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: incorrect header check$invalid window size
                                                                                                                                                                                                      • API String ID: 0-900081337
                                                                                                                                                                                                      • Opcode ID: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
                                                                                                                                                                                                      • Instruction ID: bc652a1c11335411efe1fa85640a343feed62497217ed0cae88a2069deacd86d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8c4c8a6a705a7cf803fa5291bdc529627e531fe0bdcc095ab807ab19af6e2c49
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A691B772A187C58BE7B4AF36C4C8B3A7BA9FB44354FA14139DA4A567C0CB78E540CB10
                                                                                                                                                                                                      Function 00007FF784E5EFB8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: e+000$gfff
                                                                                                                                                                                                      • API String ID: 0-3030954782
                                                                                                                                                                                                      • Opcode ID: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
                                                                                                                                                                                                      • Instruction ID: 5375e66ac49594ad24ee37bf284ede715dcc324edc397657b563f09c103751c4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab39e04084c8b9065030c447a5361eb1aff85978d5a2f70618a83e2e92251626
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7A515822B182C546E724AE36D980769FB91F744B94FA98331CBA887BC6CFBDD445C710
                                                                                                                                                                                                      Function 00007FF784E5EB24 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID: gfffffff
                                                                                                                                                                                                      • API String ID: 0-1523873471
                                                                                                                                                                                                      • Opcode ID: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
                                                                                                                                                                                                      • Instruction ID: 02bd838799d8a00ef00bd9aea34a3e6cf421d13b2d9524931257a80aee2be675
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1e22957b1159dd03df7ccd337d5a67203babfefd7ac1e182ea12ea91d3eef3d6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 06A16863B087C586EB21DF2AA0817A9BB91FB50BC4F668131DE8D87785DE7DE401C711
                                                                                                                                                                                                      Function 00007FF784E596D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: TMP
                                                                                                                                                                                                      • API String ID: 3215553584-3125297090
                                                                                                                                                                                                      • Opcode ID: 2d09a8d0b3f9f3e3f4726bcb3549591c54293473ccc366ec5b1b4d61c621e7ad
                                                                                                                                                                                                      • Instruction ID: f4347951005f569285f9d6f454f6f6293a31bb720682789a2da6adb12eb249bf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d09a8d0b3f9f3e3f4726bcb3549591c54293473ccc366ec5b1b4d61c621e7ad
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A51B011F0864251FA68BF2759915BAD291BF45BC8FEA4035DE0EC77D6EEBCE402C620
                                                                                                                                                                                                      Function 00007FF784E646F0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: HeapProcess
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 54951025-0
                                                                                                                                                                                                      • Opcode ID: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
                                                                                                                                                                                                      • Instruction ID: c6d8921779f5575ea2d880852eca3c7808e38ee9151d3f03a39a5d2e03e97215
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b79ea0c05b8e708bf2e7ff1fe6aa0946c24d08db99ce40c7e012d78a6a9acfe9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 47B09220E1BA46C6EA883F936CC2214A2B5BF58700FE54038C04C51320DE6C20A6D720
                                                                                                                                                                                                      Function 00007FF784E53F8C Relevance: .4, Instructions: 374COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
                                                                                                                                                                                                      • Instruction ID: 4faab284553728ced7cdc971a910312620eadd8d1d07d243c1330ef55274ea34
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a25825d834791a15779abc5a96815a53d20fd0a8b1de7024d724f2c7a0ffd609
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DAE1B22690864681E768BE27D1C433DA7A1FF44B48FB64235CE0D87AD9CFB9E851C361
                                                                                                                                                                                                      Function 00007FF784E53750 Relevance: .4, Instructions: 351COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
                                                                                                                                                                                                      • Instruction ID: e8e3dda90c347edf149d480b65222be63f419c2d6f49bf9c7e4ea1e5724d62a2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92f5019cce735186dcbe47a7940729bb5e8d7af8c1d6157f075a5e7b95ae45a8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E3E10871A0860285E768AE2AC0D537DA7A1FF44B44FB64236CA4D876D9CFB9E841C320
                                                                                                                                                                                                      Function 00007FF784E53B88 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
                                                                                                                                                                                                      • Instruction ID: f848404dd8e6c6d2425facad1cd5f8eb239d63054dcec2b246832ff9f1c75d42
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86da56c12cd563bcad921fbd71c05d3fa176844b52d15b5090a52c27ad8a5c54
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9D1D932A0864685EB68AE27818027DA7B0FF45B48FB64237DE0DC7695DFBDD851C360
                                                                                                                                                                                                      Function 00007FF784E48DC0 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
                                                                                                                                                                                                      • Instruction ID: c05634f4fca705d31bb43a18fe63f21b90f91c3ef04d06345c92b815eb264a44
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8e0142d1de63ac36c46e431d0d75baaff102e1c1a7ac2c303afc5037c5988706
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3AC196722141E14BD289EB29E46A57A73E1F79838DFD4803AEF8B47B85C63CE114D721
                                                                                                                                                                                                      Function 00007FF784E52420 Relevance: .2, Instructions: 250COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
                                                                                                                                                                                                      • Instruction ID: af4a398961a56e88c5ae8d7847ef4181acef35273dc332858cfa1daa76444fd0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b5780ef2d000dcd486574e33efb2770a379a55a34775bc5a7b80e7b31bbd7158
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ACB1A172A0864586E765EF3AC09023DBBA0FB45B48FB64135CB4D87395DFB9E840CB61
                                                                                                                                                                                                      Function 00007FF784E527B8 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
                                                                                                                                                                                                      • Instruction ID: 69efa2f796043b299b390a1c5c5303559e2f3ea985bc86b5ede5db8eff122c54
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 56ef1490d9aa7cb50fdbcb208ea1e35327a83dacbd264ffe23c56c6782292f60
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 17B18172A0878685E7659F3AD09023CBBA0F749B48FB64135CA8DC7396CFB9D441CB61
                                                                                                                                                                                                      Function 00007FF784E5F638 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
                                                                                                                                                                                                      • Instruction ID: 87e850ac6643ad8da613051cf9c5fd0d318ee7e30de2ef993954048d63882581
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2a05c6059b1d422c1c0961fd67960772ff2ba502e6a05041136868912dff4d23
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B81F472A1878146EB74DF1A94C037AA690FB49794FA14339DA9D87B99CFBCD400CB10
                                                                                                                                                                                                      Function 00007FF784E67688 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 9a295c8423642c4cbe815a0aaaea0e47db4d1eedc62cb34c9aae5a631900bf27
                                                                                                                                                                                                      • Instruction ID: 1fa418cde425c1401830745ca1c992b67e36f49f0fc724dd48dd26dd4f1a853c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9a295c8423642c4cbe815a0aaaea0e47db4d1eedc62cb34c9aae5a631900bf27
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0F6106A2E1C29266F724AE2A84C067DE681FF40760FB54239D61D86AC5DEFDFC40C720
                                                                                                                                                                                                      Function 00007FF784E5173C Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                      • Instruction ID: 70e0b9c99ab400bcfc423a8d85f1ea527d474d8c747e55e8d0adbaa4ec120d42
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C518336E18A5186E7249F2AC090278F3A1FB45B68F764231CE4D97794DF7AE843C790
                                                                                                                                                                                                      Function 00007FF784E50F1C Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                      • Instruction ID: 99744beb248ba69cd4476c585f80e19f1e5bbf43efe80bef111e40f073fc20a5
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A0518436A18651C6E7249F2AC090238B3A1FB44B68F758131DE4D97795DB7AE843C7A0
                                                                                                                                                                                                      Function 00007FF784E5132C Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                      • Instruction ID: 545563322e720586967baed13f5a9e963b6eb4c4d5ca00bb6ee2afeba348d029
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3518436E1865186E7249F2AC09423CF7A1FB44B68F765131CE8D97B94CB7AE843C750
                                                                                                                                                                                                      Function 00007FF784E51538 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
                                                                                                                                                                                                      • Instruction ID: 0aeff4c5f493d610e6bd2dd23bb3c1dcc29505486fb201565a532b61dfb6785f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7710b6301a9c53c0f35ccf6fc131232db227f89fb6367f1206a3fe51f4b04988
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 14517536E1865186E7249F2AC084239F7A0FB45B58FBA4131CE4D97794DFBAEC42C790
                                                                                                                                                                                                      Function 00007FF784E50D18 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
                                                                                                                                                                                                      • Instruction ID: c978b8ce4530f29a7cc44bdfe7cdc64c9da7eb389aaa1d3dc7fd5607d71f552f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3b300af1d1946d5df55db44b3d4e0876ae34829a82d49cb6751e26c04e9c1898
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D451A432A18A51C6EB249F2AC080339B7A0FB45B58FB54131EE4D97794EF7AF842C750
                                                                                                                                                                                                      Function 00007FF784E51128 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
                                                                                                                                                                                                      • Instruction ID: 1b996b2914e2a02d92cd0188af20cabd89e0144a43c58f1a25c8259d59ccff76
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c9c7dfd85d7e05c9dc9b7e40d932aad9843605f203f1a6a08d3cc10701c718b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2951C336E1865186E724AF2AD180638F7B0FB44B58F764231CE4D97795CFBAE842C790
                                                                                                                                                                                                      Function 00007FF784E56CF0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                      • Instruction ID: 8b2778e8622b94c236b340a6b730ba1b9a5930f824682350ebf064955818f68e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A41EB92C0A68B04E995BD3A45446B8A690BF53BA0DFA1670CC9D973D7CD4D2686C320
                                                                                                                                                                                                      Function 00007FF784E5AE20 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 485612231-0
                                                                                                                                                                                                      • Opcode ID: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
                                                                                                                                                                                                      • Instruction ID: 53d4da3147356a82deea9f54f7f3b36e1a81dc85bb0434203df5c7d79809d8f9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7a7ebbd17873febb15e29de35626f23177de76f7dba359f1eda69606ccc1bea3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 36411262714A5482EF14DF2BD994169B3A1FB48FD4FAA9032EE0D97B58EE7CD441C300
                                                                                                                                                                                                      Function 00007FF784E59020 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
                                                                                                                                                                                                      • Instruction ID: 4f85a57b35a2baf217cc13ef0c6d6c84f3dc47537535c00b3cb75d2df2ddca60
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3b4b82ba6feb1f2c625fcdd7b78fc6310e7e433b3778e25011fb45a65c2c329c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A131A532718B4282E724AF27648017DF695BF84B94F654238EA9D93BD6DF7CD001C714
                                                                                                                                                                                                      Function 00007FF784E6A7E0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
                                                                                                                                                                                                      • Instruction ID: c58e0ce4b17b6ebd305b2af9667dd78ce7152b271f8ec17995873e76cb9aa7c1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47026fad3db46e1691e12129f37de500b9ca6af24d2cbfa86880e77cbf706e66
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5FF06D717246D94ADB95DF19A842539B7E0F7043C0FE08039D58D83B04DABC9051CF14
                                                                                                                                                                                                      Function 00007FF784E4C8A0 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                      • Opcode ID: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
                                                                                                                                                                                                      • Instruction ID: f943e02a46c41bf5bb15b36a6b4630d60439f41f82b90bdbdc93b565977fb4f8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0095cffb8fe81db1077c877ec2d194bac0958fa6bcac770c2119ba444bc36b37
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59A0016190CC46E0F644AF12A991420A360BB54310FE10032E15D420A4EFACA400C220
                                                                                                                                                                                                      Function 00007FF784E44C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C50
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C62
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C99
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CAB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CC4
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CD6
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CEF
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D01
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D1D
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D2F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D4B
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D5D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D79
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D8B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DA7
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DB9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DD5
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DE7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorLastProc
                                                                                                                                                                                                      • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                      • API String ID: 199729137-653951865
                                                                                                                                                                                                      • Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                                                                                                                                                      • Instruction ID: b83f00f344df2a699ab663129ccdbad8239521ab33ece0f21282446e12770d80
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8229F24A0DF07A1FE54BF6BB8C45B4A3A1BF48745FE81436D84E016A4EFBCB549C220
                                                                                                                                                                                                      Function 00007FF784E47610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E48950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF784E43A04,00000000,00007FF784E41965), ref: 00007FF784E48989
                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF784E47CF7,FFFFFFFF,00000000,?,00007FF784E43101), ref: 00007FF784E4766C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                      • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                      • API String ID: 2001182103-930877121
                                                                                                                                                                                                      • Opcode ID: b30a72d36afce0cd8273f42ba79e9994321ef07812378637c8fd6fc8c555bb8b
                                                                                                                                                                                                      • Instruction ID: 9029889422f078b30c55609883ad64b062bf2269c24c95d99c365db933a911fc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b30a72d36afce0cd8273f42ba79e9994321ef07812378637c8fd6fc8c555bb8b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C516421A2CE4251FB50BF37E8D56BAE351FF94780FE40432DA4E42695EEACE504C7A0
                                                                                                                                                                                                      Function 00007FF784E47500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                      • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                      • API String ID: 3975851968-2863640275
                                                                                                                                                                                                      • Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                                                                                                                                                      • Instruction ID: 68f14960e5e4e397aec13b0ae41dec5a9328472392b8d77af9ba6bf217baa002
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C421A361F0CE4292E751AF7BA8C4579A351FF88BA0FE84230DE5D87394DEACD580C220
                                                                                                                                                                                                      Function 00007FF784E57250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: -$:$f$p$p
                                                                                                                                                                                                      • API String ID: 3215553584-2013873522
                                                                                                                                                                                                      • Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                                                                                                                                                      • Instruction ID: a4b86297f808199d8bacac01fff60c56aa246dc7214c479060a2a49211234cc1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0812A462E0C15386FB207F16E0C4679F691FB40750FE64536E69A86AC4DFBCE4A0CB20
                                                                                                                                                                                                      Function 00007FF784E505A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: f$f$p$p$f
                                                                                                                                                                                                      • API String ID: 3215553584-1325933183
                                                                                                                                                                                                      • Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                                                                                                                                                      • Instruction ID: 24f71e289ce6bb4a884ac80f17c9e63742927df62e0e4d0a0fbd6d4dfcb0057b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72126462A0D143C5FB64BE16D0D46B9F2A1FB90754FE54035F68A866C5EFBCE480CB20
                                                                                                                                                                                                      Function 00007FF784E41030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-3659356012
                                                                                                                                                                                                      • Opcode ID: 0132699da5e8359bb8b127c5446403dd8da8ddb8cc5c79fad84b5d1f0ff81564
                                                                                                                                                                                                      • Instruction ID: c02f4f3be71f034a109405f4668edbb52ab4b33c36c8de68bff571d0151b00d0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0132699da5e8359bb8b127c5446403dd8da8ddb8cc5c79fad84b5d1f0ff81564
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B416022B0CA9295EA00FF2398886B9E391BF44BD4FE44532ED4D47796DEBCE505C760
                                                                                                                                                                                                      Function 00007FF784E41450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-3659356012
                                                                                                                                                                                                      • Opcode ID: 43db9420e6fcfd44c7f97dfcade2ab5aa79b96fdf83da4508acfd26722623ef4
                                                                                                                                                                                                      • Instruction ID: 24209b2a4859bb3ab73f035e92913d28c82bdb54248bf52471bc97a707499fb3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43db9420e6fcfd44c7f97dfcade2ab5aa79b96fdf83da4508acfd26722623ef4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80414C32A08A8295EE00FF3394856F9E391BF48794FE44432ED4D47A99DEBCE501C720
                                                                                                                                                                                                      Function 00007FF784E4DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 849930591-393685449
                                                                                                                                                                                                      • Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                                                                                                                                                      • Instruction ID: d4151b98b99412d0c0af051eb72f6f67dc9181724e383854df8a9316a3066948
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3D16032A08B4186EB20AF7A94807ADB7A0FB55798FA00135EE8D57B95DF7CE481C711
                                                                                                                                                                                                      Function 00007FF784E42310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E42360
                                                                                                                                                                                                      • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E4241A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentFormatMessageProcess
                                                                                                                                                                                                      • String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
                                                                                                                                                                                                      • API String ID: 27993502-4247535189
                                                                                                                                                                                                      • Opcode ID: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                                                                                                                                                      • Instruction ID: eb83595fb3209f398ffcb262a610ad5081c5876152463499503d92b5fb7fad27
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92e20a795bf73765402ca9ec7783ee5ad9f8f927f89bd5dd19570627e0bc01fb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4531E262B08A4151EA20BF36B8846AAE361FF84BD5FD10135EF8D93A59DE7CE106C710
                                                                                                                                                                                                      Function 00007FF784E4D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D2DD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D2EB
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D315
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D383
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D38F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                                      • Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                                                                                                                                                      • Instruction ID: db04b3c516f8c704423ca27faaf446b5c2a7eff6ec977ee6c2a5b8a85646aab7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B31B421B1AE4291EE52AF23A480A79A3D4FF49BA4FE90535DD9D47780DFBCE445C320
                                                                                                                                                                                                      Function 00007FF784E457A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                      • API String ID: 2050909247-2434346643
                                                                                                                                                                                                      • Opcode ID: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
                                                                                                                                                                                                      • Instruction ID: 64ec8a01529e5d00dc39335cc0a79e712aae80c86df72c7cad02fe0bc64b3ec2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57f2e03855a98cc957638366e02885260eb86ee0512a8128b0f554b17f515a16
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C418331A18E8AA1EA10FF72E4841E9E315FB54794FE00532E65D436D6EFBCE605C760
                                                                                                                                                                                                      Function 00007FF784E5C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: 6cd12d297b2340e5ffa7c7392ce0e4cdced9a85fa0896577ca3510b685e0d80d
                                                                                                                                                                                                      • Instruction ID: 4ab88c7342ca011cc9646d3e74635411f7faf361902bb434aeb81fcd58ff9cf0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6cd12d297b2340e5ffa7c7392ce0e4cdced9a85fa0896577ca3510b685e0d80d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3214110A0C24242F9A5BF2396D1139D292BF447B0FF54734D93E976D6EDECA841C320
                                                                                                                                                                                                      Function 00007FF784E68FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                                      • Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                                                                                                                                                      • Instruction ID: a801be8fad3792f7d685fcc31638cee1f42f7256b721e25a4ac5e90c1c8a847a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D116021B18A4186E790AF53F884729A6A0FB98BE4FA44234EA5D87794DFBCD414C750
                                                                                                                                                                                                      Function 00007FF784E479B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF784E48706), ref: 00007FF784E479E2
                                                                                                                                                                                                      • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47A39
                                                                                                                                                                                                        • Part of subcall function 00007FF784E48950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF784E43A04,00000000,00007FF784E41965), ref: 00007FF784E48989
                                                                                                                                                                                                      • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47AC8
                                                                                                                                                                                                      • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B34
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B45
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B5A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3462794448-0
                                                                                                                                                                                                      • Opcode ID: e394586919bb787c5c57ed27fc0ac332066dc84938bb9692acbe845e24378f8e
                                                                                                                                                                                                      • Instruction ID: 8c7e4533666c868978b95f8109ba740849e318b5ec632d88f8712f48edcea338
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e394586919bb787c5c57ed27fc0ac332066dc84938bb9692acbe845e24378f8e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E341A362B19E8241EA30AF23A5C06AAA395FF84BC4F950135DF8D577C9DE7CE501C760
                                                                                                                                                                                                      Function 00007FF784E5C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C1D7
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C20D
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C23A
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C24B
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C25C
                                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C277
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: 297eb830bf51183a03152683679a33ac8e7e939d0b2a29d40b44e033b6affbc9
                                                                                                                                                                                                      • Instruction ID: 9186a9f8f7af570b9f9e0698da34f567a271172a51cd587d5c1bbd9f6a5a7ecf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 297eb830bf51183a03152683679a33ac8e7e939d0b2a29d40b44e033b6affbc9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4115E24A0C65242FA94BFA3A6D1139D192BF447B0FF54734DC2E966D6EEECA841C320
                                                                                                                                                                                                      Function 00007FF784E5A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                                                                                                                                                      • Instruction ID: 3d0da61b76cfdf17f27a85be50f92eb419fba3f2c0bb7522c9d58099b29f47e0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCF0F661B1CB0291FB20AF62E4C47399320FF49761FE40635CAAE862E4CFACD044C720
                                                                                                                                                                                                      Function 00007FF784E6A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                                      • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                      • Instruction ID: 356212c949d01d1593e20e7bf22a0e37e585d25e51534fa52aee0e6b0069092b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16116D72E58B0221FA743926D5D237FB0507F5A368FA45A34E96E072D6CEECA851C131
                                                                                                                                                                                                      Function 00007FF784E5C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2AF
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2CE
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2F6
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C307
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C318
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 336e871d9fe7b9feb1d4e8714057d4483739f4a760c37d9f3dc9b8317e64e27b
                                                                                                                                                                                                      • Instruction ID: 245238a339ee0f4bbd9a4d11596c447c1cfc468ad8c64cb8a969a8952493eb7f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 336e871d9fe7b9feb1d4e8714057d4483739f4a760c37d9f3dc9b8317e64e27b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73116011E0C64642F9A4BF67A5D1179A181BF447B0FE54334E92E966D6EDECA802C220
                                                                                                                                                                                                      Function 00007FF784E5C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 4d8455bc275ec880ad9f8951d6e4f70d9feb0184cd7bbcf1a18e1e455a1bd2fd
                                                                                                                                                                                                      • Instruction ID: 174f68d03fa3c1c83b7fb5f63a21e084d6e565dee82e3fb4e00d367b166aa7d1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4d8455bc275ec880ad9f8951d6e4f70d9feb0184cd7bbcf1a18e1e455a1bd2fd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26110A10A0824742F9A9BE7389E117991916F54370FFA1734DA3E9A2D7EDECB801C670
                                                                                                                                                                                                      Function 00007FF784E485B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Process$ConsoleCurrentShowSleepThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3908687701-0
                                                                                                                                                                                                      • Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                                                                                                                                                      • Instruction ID: f87901b7b9df9eb086b4455fc05136a7e23ab154be23396b5ae9f7659efc5c62
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5016D24E1CB4282EA546F37B4C4439A3A0FF44B84FE45135DA8F46668DEBCE841C720
                                                                                                                                                                                                      Function 00007FF784E56F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: verbose
                                                                                                                                                                                                      • API String ID: 3215553584-579935070
                                                                                                                                                                                                      • Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                                                                                                                                                      • Instruction ID: efc8fe9f20488b09a4daa4d9a05623981f5beecbd0221e2831124390d685085e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D91DF32A08A4681F721AE66D4D077DB791BB04B94FE64236DA5DC73C5DEBCE812C321
                                                                                                                                                                                                      Function 00007FF784E60E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                      • API String ID: 3215553584-1196891531
                                                                                                                                                                                                      • Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                                                                                                                                                      • Instruction ID: 005e66dccaa3fd2d11934799cbf9872bf5fadee3165abbd6f8d0baba4eec5ebd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E781B432D08262A5FBA6AF67C190279F6A0BB11744FF59038CA0D57285EFADE801D761
                                                                                                                                                                                                      Function 00007FF784E4CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2395640692-1018135373
                                                                                                                                                                                                      • Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                                                                                                                                                      • Instruction ID: 9f7c9da73fd5bde78c1fd4898a418c21e84d3c247de96a96774fe3b427e0ebcb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1851B932B19A018ADB14EF26E084A7DB791FB44B98FA24131DE4D47788DFBDE841D710
                                                                                                                                                                                                      Function 00007FF784E4E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                                      • Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                                                                                                                                                      • Instruction ID: 13528c6db90180aefb9ebbb0f55bb2f51ca19ba395c73ac4618960a9daf00f87
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4516F32908A4286EB74AF7B9084368B790FB54B94FA84175DB8C477D5CFBCE891C711
                                                                                                                                                                                                      Function 00007FF784E4E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                                      • Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                                                                                                                                                      • Instruction ID: 1841808d44fb6b8bc8728af3f19d155022425b71b17f74053bcdc23511727142
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ED618332908BC585D760AF2AE4807AAF7A0FB94794F544635EB9C07B95DFBCE190CB10
                                                                                                                                                                                                      Function 00007FF784E42220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF784E4866F), ref: 00007FF784E4226E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: %ls$WARNING$[PYI-%d:%ls]
                                                                                                                                                                                                      • API String ID: 2050909247-3372507544
                                                                                                                                                                                                      • Opcode ID: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                                                                                                                                                      • Instruction ID: 8b58b8206e607ccb4b30a453586d108277dbf9da5158026de0c0fbf0688cc8ca
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 92da2cbc5b979b0862b6cfd95371d042a7d5931ee882c49d5c626b31f152fc77
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A321C52261CB8251E610AF62F4856EAF354FF847C4F900135EA8D53A5ADE7CE215C750
                                                                                                                                                                                                      Function 00007FF784E5D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                                      • Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                                                                                                                                                      • Instruction ID: c98a800f992210f9b69e821fb3198d88b4eb90f5d5102b362209f7112b0fb730
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18D13532F08A4089E710DF76D4806ACB7B5FB44798FA58235CE9E97B99DE78E406C710
                                                                                                                                                                                                      Function 00007FF784E66D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                                      • Opcode ID: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
                                                                                                                                                                                                      • Instruction ID: f7a0517e38f074684324dcc8deeaf156180c81a25e6df577673eb96878412b45
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44877219fa58a3c80076740d489941753dcdf7d4d18713102933f3384318ca38
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B411712A2828266FB60AF37D48137EE660FB90BA4FA44235EE5E06AD5DE7CD541C710
                                                                                                                                                                                                      Function 00007FF784E59F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E59F82
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF784E4C165), ref: 00007FF784E59FA0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                      • API String ID: 3580290477-2622834535
                                                                                                                                                                                                      • Opcode ID: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
                                                                                                                                                                                                      • Instruction ID: 19c9a2128df4c61b92639832a30f6db33f3ea4327c80a36e1e24d6bb509b39b0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2a2f06ea51d58fd39cad35a47b9855af257a0ebd26d3c321afc8fcfaab6f6b1a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8417332A08B5285EB25FF23A4C00BDA7A4FB44794FA64035EA4E87B55EFBDD441C320
                                                                                                                                                                                                      Function 00007FF784E5DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                                      • Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                                                                                                                                                      • Instruction ID: 78b7b772a37525ab0e67d1f470ce56fa23c33375b440e9857f4f990a93f55837
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9141F622718A8181EB60EF26E4847B9B761FB84794FE14031EE8D87758EFBCD501C710
                                                                                                                                                                                                      Function 00007FF784E42020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF784E41B4A), ref: 00007FF784E42070
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: %s: %s$[PYI-%d:ERROR]
                                                                                                                                                                                                      • API String ID: 2050909247-3704582800
                                                                                                                                                                                                      • Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                                                                                                                                                      • Instruction ID: deb38be427c003165ec71feeaa837b9267b9d370f8f719f951837e48fce36f38
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC21EA62B18A8155EA20AF72BC816E6E394BFC47D4F910131FE8D57749DE7CD155C210
                                                                                                                                                                                                      Function 00007FF784E60828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                      • API String ID: 1611563598-336475711
                                                                                                                                                                                                      • Opcode ID: e405b3d95a77a686cd9e65060fb5efdbb8b04b637a4feec6827f9fe163836890
                                                                                                                                                                                                      • Instruction ID: ecc05c86831bf7ab86dce5660682b71947316955e12803338258768191e0b9e3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e405b3d95a77a686cd9e65060fb5efdbb8b04b637a4feec6827f9fe163836890
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC21A222A0869191FB20EF26D48427DA3B1FB98B84FE54135D68D43685EFBCE945C7A0
                                                                                                                                                                                                      Function 00007FF784E41E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF784E41B79), ref: 00007FF784E41E9E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: ERROR$[PYI-%d:%s]
                                                                                                                                                                                                      • API String ID: 2050909247-3005936843
                                                                                                                                                                                                      • Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                                                                                                                                                      • Instruction ID: 5f90ccfed1a629e1e8dc7885d5bc1c7e908c63647010913a0058877ea16caa6a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6118E22618B8551EA20AF62B8856EAF364FB847C4F900135FA8D43A5ADEBCD255C710
                                                                                                                                                                                                      Function 00007FF784E42140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF784E428DA,FFFFFFFF,00000000,00007FF784E4336A), ref: 00007FF784E4218E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: WARNING$[PYI-%d:%s]
                                                                                                                                                                                                      • API String ID: 2050909247-3752221249
                                                                                                                                                                                                      • Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                                                                                                                                                      • Instruction ID: 25fb3be4ac42f1119da6eb321ab325bf0fba1b1f5ba65daa82ee57d3db8799b8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F118E22618B8551EA20AF62B8816EAF354FB847C4F900135FA8D43B5ADEBCD255C710
                                                                                                                                                                                                      Function 00007FF784E4F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                                      • Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                                                                                                                                                      • Instruction ID: 9e52011cde8873767f38295016449a268ea840346dd973f721c4b3b4a0ccd80f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22112E32618B8182EB619F26F580269B7E4FB88B94FA84234DECD07758DF7CD551C710
                                                                                                                                                                                                      Function 00007FF784E619AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000000.00000002.1588578201.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588547406.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588617198.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588651325.00007FF784E84000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000000.00000002.1588712821.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                      • API String ID: 2595371189-336475711
                                                                                                                                                                                                      • Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                                                                                                                                                      • Instruction ID: 3278c317dba19ab198601585474856319d773e938eea94a9243fe5f9f7672f1c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D201842291C64285F721BFA2D4A127EE3A0FF44708FE05535D54D82699DFBCE504CB24

                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                      Execution Coverage:5.8%
                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                      Signature Coverage:0%
                                                                                                                                                                                                      Total number of Nodes:734
                                                                                                                                                                                                      Total number of Limit Nodes:12
                                                                                                                                                                                                      execution_graph 26333 7ffbaa651f90 PyType_IsSubtype __stdio_common_vsprintf 26334 7ffbaa651590 PyType_IsSubtype PyUnicode_FromString _PyArg_BadArgument _PyUnicode_Ready 26375 7ffbaa654c90 7 API calls 26376 7ffbaa652690 PyObject_GC_UnTrack PyObject_GC_Del _Py_Dealloc 26313 7ff784e5ac10 GetCommandLineA GetCommandLineW 26348 7ff784e4c110 57 API calls 2 library calls 26378 7ff784e68e90 65 API calls 26314 7ff784e60bfc 55 API calls 3 library calls 25352 7ff784e4c1fc 25373 7ff784e4c3dc 25352->25373 25355 7ff784e4c21d __scrt_acquire_startup_lock 25358 7ff784e4c35d 25355->25358 25362 7ff784e4c23b __scrt_release_startup_lock 25355->25362 25356 7ff784e4c353 25534 7ff784e4c6fc 7 API calls 2 library calls 25356->25534 25535 7ff784e4c6fc 7 API calls 2 library calls 25358->25535 25360 7ff784e4c260 25361 7ff784e4c368 __GetCurrentState 25362->25360 25363 7ff784e4c2e6 25362->25363 25531 7ff784e5aa64 45 API calls 25362->25531 25381 7ff784e5a6b8 25363->25381 25366 7ff784e4c2eb 25387 7ff784e41000 25366->25387 25370 7ff784e4c30f 25370->25361 25533 7ff784e4c560 7 API calls 25370->25533 25372 7ff784e4c326 25372->25360 25374 7ff784e4c3e4 25373->25374 25375 7ff784e4c3f0 __scrt_dllmain_crt_thread_attach 25374->25375 25376 7ff784e4c3fd 25375->25376 25379 7ff784e4c215 25375->25379 25536 7ff784e5b30c 25376->25536 25379->25355 25379->25356 25382 7ff784e5a6c8 25381->25382 25386 7ff784e5a6dd 25381->25386 25382->25386 25553 7ff784e5a148 40 API calls Concurrency::details::SchedulerProxy::DeleteThis 25382->25553 25384 7ff784e5a6e6 25384->25386 25554 7ff784e5a508 12 API calls 3 library calls 25384->25554 25386->25366 25388 7ff784e42b80 25387->25388 25555 7ff784e563c0 25388->25555 25390 7ff784e42bbc 25562 7ff784e42a70 25390->25562 25397 7ff784e42bfd 25665 7ff784e41c60 25397->25665 25398 7ff784e42cdb 25670 7ff784e439d0 25398->25670 25401 7ff784e42c1c 25634 7ff784e47e70 25401->25634 25404 7ff784e42d2a 25693 7ff784e41e50 25404->25693 25406 7ff784e42c4f 25414 7ff784e42c7b __vcrt_freefls 25406->25414 25669 7ff784e47fe0 40 API calls __vcrt_freefls 25406->25669 25408 7ff784e42d1d 25409 7ff784e42d22 25408->25409 25410 7ff784e42d45 25408->25410 25689 7ff784e4f5a4 25409->25689 25412 7ff784e41c60 49 API calls 25410->25412 25415 7ff784e42d64 25412->25415 25416 7ff784e47e70 14 API calls 25414->25416 25423 7ff784e42c9e __vcrt_freefls 25414->25423 25420 7ff784e41930 115 API calls 25415->25420 25416->25423 25418 7ff784e42dcc 25705 7ff784e47fe0 40 API calls __vcrt_freefls 25418->25705 25422 7ff784e42d8e 25420->25422 25421 7ff784e42dd8 25706 7ff784e47fe0 40 API calls __vcrt_freefls 25421->25706 25422->25401 25425 7ff784e42d9e 25422->25425 25429 7ff784e42cce __vcrt_freefls 25423->25429 25704 7ff784e47f80 40 API calls __vcrt_freefls 25423->25704 25427 7ff784e41e50 81 API calls 25425->25427 25426 7ff784e42de4 25707 7ff784e47fe0 40 API calls __vcrt_freefls 25426->25707 25435 7ff784e42bc9 __vcrt_freefls 25427->25435 25430 7ff784e47e70 14 API calls 25429->25430 25431 7ff784e42e04 25430->25431 25432 7ff784e42ef9 25431->25432 25433 7ff784e42e29 __vcrt_freefls 25431->25433 25434 7ff784e41e50 81 API calls 25432->25434 25445 7ff784e42e6c 25433->25445 25708 7ff784e47f80 40 API calls __vcrt_freefls 25433->25708 25434->25435 25711 7ff784e4bb10 25435->25711 25437 7ff784e4303a 25441 7ff784e47e70 14 API calls 25437->25441 25438 7ff784e43033 25709 7ff784e48510 GetConsoleWindow GetCurrentProcessId GetWindowThreadProcessId ShowWindow Sleep 25438->25709 25440 7ff784e43038 25440->25437 25442 7ff784e4304f __vcrt_freefls 25441->25442 25443 7ff784e4308a 25442->25443 25444 7ff784e43187 25442->25444 25446 7ff784e4311a 25443->25446 25447 7ff784e43094 25443->25447 25721 7ff784e438f0 49 API calls 25444->25721 25445->25437 25445->25438 25450 7ff784e47e70 14 API calls 25446->25450 25710 7ff784e485c0 88 API calls _log10_special 25447->25710 25453 7ff784e43126 25450->25453 25451 7ff784e43195 25454 7ff784e431b7 25451->25454 25455 7ff784e431ab 25451->25455 25452 7ff784e43099 25456 7ff784e430f9 25452->25456 25457 7ff784e430a5 25452->25457 25453->25457 25461 7ff784e43133 25453->25461 25459 7ff784e41c60 49 API calls 25454->25459 25722 7ff784e43a40 25455->25722 25720 7ff784e47ca0 113 API calls 2 library calls 25456->25720 25464 7ff784e41e50 81 API calls 25457->25464 25473 7ff784e43171 __vcrt_freefls 25459->25473 25465 7ff784e41c60 49 API calls 25461->25465 25462 7ff784e4320a 25647 7ff784e48950 25462->25647 25463 7ff784e43101 25467 7ff784e4310e 25463->25467 25468 7ff784e43105 25463->25468 25464->25435 25469 7ff784e43151 25465->25469 25467->25473 25468->25457 25472 7ff784e43158 25469->25472 25469->25473 25470 7ff784e431ed SetDllDirectoryW LoadLibraryExW 25470->25462 25471 7ff784e4321d SetDllDirectoryW 25476 7ff784e43250 25471->25476 25522 7ff784e432a1 25471->25522 25474 7ff784e41e50 81 API calls 25472->25474 25473->25462 25473->25470 25474->25435 25478 7ff784e47e70 14 API calls 25476->25478 25477 7ff784e43433 25480 7ff784e4343e 25477->25480 25481 7ff784e43445 25477->25481 25486 7ff784e4325c __vcrt_freefls 25478->25486 25479 7ff784e43362 25733 7ff784e42780 119 API calls 2 library calls 25479->25733 25735 7ff784e48510 GetConsoleWindow GetCurrentProcessId GetWindowThreadProcessId ShowWindow Sleep 25480->25735 25652 7ff784e42720 25481->25652 25484 7ff784e4336a 25484->25435 25734 7ff784e48590 LocalFree 25484->25734 25485 7ff784e43443 25485->25481 25487 7ff784e43339 25486->25487 25491 7ff784e43295 25486->25491 25732 7ff784e47f80 40 API calls __vcrt_freefls 25487->25732 25491->25522 25725 7ff784e46200 87 API calls _get_daylight 25491->25725 25504 7ff784e432b3 25726 7ff784e46780 115 API calls 2 library calls 25504->25726 25505 7ff784e43474 25509 7ff784e432c8 25512 7ff784e432e9 25509->25512 25523 7ff784e432cc 25509->25523 25727 7ff784e46240 118 API calls _log10_special 25509->25727 25512->25523 25728 7ff784e465f0 150 API calls 25512->25728 25516 7ff784e432fe 25516->25523 25729 7ff784e46930 82 API calls 25516->25729 25517 7ff784e43327 25731 7ff784e46400 FreeLibrary 25517->25731 25522->25477 25522->25479 25523->25522 25730 7ff784e42140 81 API calls _log10_special 25523->25730 25531->25363 25532 7ff784e4c84c GetModuleHandleW 25532->25370 25533->25372 25534->25358 25535->25361 25537 7ff784e6471c 25536->25537 25538 7ff784e4c402 25537->25538 25541 7ff784e5d420 25537->25541 25538->25379 25540 7ff784e4ce18 7 API calls 2 library calls 25538->25540 25540->25379 25552 7ff784e61548 EnterCriticalSection 25541->25552 25543 7ff784e5d430 25544 7ff784e592a4 43 API calls 25543->25544 25545 7ff784e5d439 25544->25545 25546 7ff784e5d447 25545->25546 25547 7ff784e5d228 45 API calls 25545->25547 25548 7ff784e615a8 _isindst LeaveCriticalSection 25546->25548 25549 7ff784e5d442 25547->25549 25550 7ff784e5d453 25548->25550 25551 7ff784e5d318 GetStdHandle GetFileType 25549->25551 25550->25537 25551->25546 25553->25384 25554->25386 25558 7ff784e606f0 25555->25558 25556 7ff784e60743 25737 7ff784e5b758 37 API calls 2 library calls 25556->25737 25558->25556 25560 7ff784e60796 25558->25560 25559 7ff784e6076c 25559->25390 25738 7ff784e605c8 71 API calls _fread_nolock 25560->25738 25739 7ff784e4be10 25562->25739 25565 7ff784e42aab GetLastError 25746 7ff784e42310 80 API calls _log10_special 25565->25746 25566 7ff784e42ad0 25741 7ff784e48840 FindFirstFileExW 25566->25741 25570 7ff784e42b3d 25749 7ff784e48a00 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 25570->25749 25571 7ff784e42ae3 25747 7ff784e488c0 CreateFileW GetFinalPathNameByHandleW CloseHandle 25571->25747 25573 7ff784e4bb10 _log10_special 8 API calls 25576 7ff784e42b75 25573->25576 25575 7ff784e42af0 25578 7ff784e42af4 25575->25578 25582 7ff784e42b0c __vcrt_InitializeCriticalSectionEx 25575->25582 25576->25435 25584 7ff784e41930 25576->25584 25577 7ff784e42b4b 25583 7ff784e42ac6 25577->25583 25750 7ff784e41f30 78 API calls _log10_special 25577->25750 25748 7ff784e41f30 78 API calls _log10_special 25578->25748 25581 7ff784e42b05 25581->25583 25582->25570 25583->25573 25585 7ff784e439d0 108 API calls 25584->25585 25586 7ff784e41965 25585->25586 25587 7ff784e41c23 25586->25587 25588 7ff784e473d0 83 API calls 25586->25588 25589 7ff784e4bb10 _log10_special 8 API calls 25587->25589 25590 7ff784e419ab 25588->25590 25591 7ff784e41c3e 25589->25591 25633 7ff784e419e3 25590->25633 25751 7ff784e4fc2c 25590->25751 25591->25397 25591->25398 25593 7ff784e4f5a4 74 API calls 25593->25587 25594 7ff784e419c5 25595 7ff784e419c9 25594->25595 25596 7ff784e419e8 25594->25596 25758 7ff784e55e48 11 API calls _get_daylight 25595->25758 25755 7ff784e4f8f4 25596->25755 25600 7ff784e419ce 25759 7ff784e42020 87 API calls _log10_special 25600->25759 25601 7ff784e41a06 25760 7ff784e55e48 11 API calls _get_daylight 25601->25760 25602 7ff784e41a25 25607 7ff784e41a3c 25602->25607 25608 7ff784e41a5b 25602->25608 25605 7ff784e41a0b 25761 7ff784e42020 87 API calls _log10_special 25605->25761 25762 7ff784e55e48 11 API calls _get_daylight 25607->25762 25610 7ff784e41c60 49 API calls 25608->25610 25611 7ff784e41a72 25610->25611 25613 7ff784e41c60 49 API calls 25611->25613 25612 7ff784e41a41 25763 7ff784e42020 87 API calls _log10_special 25612->25763 25615 7ff784e41abd 25613->25615 25616 7ff784e4fc2c 73 API calls 25615->25616 25617 7ff784e41ae1 25616->25617 25618 7ff784e41af6 25617->25618 25619 7ff784e41b15 25617->25619 25764 7ff784e55e48 11 API calls _get_daylight 25618->25764 25621 7ff784e4f8f4 _fread_nolock 53 API calls 25619->25621 25623 7ff784e41b2a 25621->25623 25622 7ff784e41afb 25765 7ff784e42020 87 API calls _log10_special 25622->25765 25625 7ff784e41b30 25623->25625 25626 7ff784e41b4f 25623->25626 25766 7ff784e55e48 11 API calls _get_daylight 25625->25766 25768 7ff784e4f668 37 API calls 2 library calls 25626->25768 25629 7ff784e41b35 25767 7ff784e42020 87 API calls _log10_special 25629->25767 25630 7ff784e41b69 25632 7ff784e41e50 81 API calls 25630->25632 25630->25633 25632->25633 25633->25593 25635 7ff784e47e7a 25634->25635 25636 7ff784e48950 2 API calls 25635->25636 25637 7ff784e47e99 GetEnvironmentVariableW 25636->25637 25638 7ff784e47f02 25637->25638 25639 7ff784e47eb6 ExpandEnvironmentStringsW 25637->25639 25640 7ff784e4bb10 _log10_special 8 API calls 25638->25640 25639->25638 25641 7ff784e47ed8 25639->25641 25642 7ff784e47f14 25640->25642 25798 7ff784e48a00 WideCharToMultiByte WideCharToMultiByte __vcrt_freefls 25641->25798 25642->25406 25644 7ff784e47eea 25645 7ff784e4bb10 _log10_special 8 API calls 25644->25645 25646 7ff784e47efa 25645->25646 25646->25406 25648 7ff784e48972 MultiByteToWideChar 25647->25648 25651 7ff784e48996 25647->25651 25650 7ff784e489ac __vcrt_freefls 25648->25650 25648->25651 25649 7ff784e489b3 MultiByteToWideChar 25649->25650 25650->25471 25651->25649 25651->25650 25799 7ff784e457a0 25652->25799 25656 7ff784e42741 25660 7ff784e42759 25656->25660 25867 7ff784e45490 25656->25867 25658 7ff784e4274d 25658->25660 25876 7ff784e45620 81 API calls 25658->25876 25661 7ff784e42a30 25660->25661 25662 7ff784e42a3e 25661->25662 25663 7ff784e42a4f 25662->25663 25980 7ff784e484a0 FreeLibrary 25662->25980 25736 7ff784e46400 FreeLibrary 25663->25736 25666 7ff784e41c85 25665->25666 25981 7ff784e558c4 25666->25981 25669->25414 25671 7ff784e439dc 25670->25671 25672 7ff784e48950 2 API calls 25671->25672 25673 7ff784e43a04 25672->25673 25674 7ff784e48950 2 API calls 25673->25674 25675 7ff784e43a17 25674->25675 26008 7ff784e56f54 25675->26008 25678 7ff784e4bb10 _log10_special 8 API calls 25679 7ff784e42ceb 25678->25679 25679->25404 25680 7ff784e473d0 25679->25680 25681 7ff784e473f4 25680->25681 25682 7ff784e474cb __vcrt_freefls 25681->25682 25683 7ff784e4fc2c 73 API calls 25681->25683 25682->25408 25684 7ff784e47410 25683->25684 25684->25682 26176 7ff784e58804 25684->26176 25686 7ff784e47425 25686->25682 25687 7ff784e4fc2c 73 API calls 25686->25687 25688 7ff784e4f8f4 _fread_nolock 53 API calls 25686->25688 25687->25686 25688->25686 25690 7ff784e4f5d4 25689->25690 26192 7ff784e4f380 25690->26192 25692 7ff784e4f5ed 25692->25404 25694 7ff784e4be10 25693->25694 25695 7ff784e41e74 GetCurrentProcessId 25694->25695 25696 7ff784e41c60 49 API calls 25695->25696 25697 7ff784e41ec5 25696->25697 25698 7ff784e558c4 49 API calls 25697->25698 25699 7ff784e41f02 25698->25699 26204 7ff784e41cc0 25699->26204 25702 7ff784e4bb10 _log10_special 8 API calls 25703 7ff784e41f1c 25702->25703 25703->25435 25704->25418 25705->25421 25706->25426 25707->25429 25708->25445 25709->25440 25710->25452 25713 7ff784e4bb19 25711->25713 25712 7ff784e430ec 25712->25532 25713->25712 25714 7ff784e4bea0 IsProcessorFeaturePresent 25713->25714 25715 7ff784e4beb8 25714->25715 26236 7ff784e4c098 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 25715->26236 25717 7ff784e4becb 26237 7ff784e4be60 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 25717->26237 25720->25463 25721->25451 25723 7ff784e41c60 49 API calls 25722->25723 25724 7ff784e43a70 25723->25724 25724->25473 25725->25504 25726->25509 25727->25512 25728->25516 25729->25523 25730->25517 25731->25522 25732->25522 25733->25484 25735->25485 25736->25505 25737->25559 25738->25559 25740 7ff784e42a7c GetModuleFileNameW 25739->25740 25740->25565 25740->25566 25742 7ff784e4887f FindClose 25741->25742 25743 7ff784e48892 25741->25743 25742->25743 25744 7ff784e4bb10 _log10_special 8 API calls 25743->25744 25745 7ff784e42ada 25744->25745 25745->25570 25745->25571 25746->25583 25747->25575 25748->25581 25749->25577 25750->25583 25752 7ff784e4fc5c 25751->25752 25769 7ff784e4f9bc 25752->25769 25754 7ff784e4fc75 25754->25594 25782 7ff784e4f914 25755->25782 25758->25600 25759->25633 25760->25605 25761->25633 25762->25612 25763->25633 25764->25622 25765->25633 25766->25629 25767->25633 25768->25630 25770 7ff784e4fa26 25769->25770 25771 7ff784e4f9e6 25769->25771 25770->25771 25773 7ff784e4fa32 25770->25773 25781 7ff784e5b758 37 API calls 2 library calls 25771->25781 25780 7ff784e562dc EnterCriticalSection 25773->25780 25775 7ff784e4fa37 25777 7ff784e4fb40 71 API calls 25775->25777 25776 7ff784e4fa0d 25776->25754 25778 7ff784e4fa49 25777->25778 25779 7ff784e562e8 _fread_nolock LeaveCriticalSection 25778->25779 25779->25776 25781->25776 25783 7ff784e4f93e 25782->25783 25794 7ff784e41a00 25782->25794 25784 7ff784e4f94d memcpy_s 25783->25784 25785 7ff784e4f98a 25783->25785 25783->25794 25796 7ff784e55e48 11 API calls _get_daylight 25784->25796 25795 7ff784e562dc EnterCriticalSection 25785->25795 25788 7ff784e4f992 25790 7ff784e4f694 _fread_nolock 51 API calls 25788->25790 25789 7ff784e4f962 25797 7ff784e5b824 37 API calls _invalid_parameter_noinfo 25789->25797 25791 7ff784e4f9a9 25790->25791 25793 7ff784e562e8 _fread_nolock LeaveCriticalSection 25791->25793 25793->25794 25794->25601 25794->25602 25796->25789 25797->25794 25798->25644 25800 7ff784e457b5 25799->25800 25801 7ff784e41c60 49 API calls 25800->25801 25802 7ff784e457f1 25801->25802 25803 7ff784e457fa 25802->25803 25804 7ff784e4581d 25802->25804 25805 7ff784e41e50 81 API calls 25803->25805 25806 7ff784e43a40 49 API calls 25804->25806 25822 7ff784e45813 25805->25822 25807 7ff784e45835 25806->25807 25808 7ff784e45853 25807->25808 25810 7ff784e41e50 81 API calls 25807->25810 25877 7ff784e43970 25808->25877 25809 7ff784e4bb10 _log10_special 8 API calls 25812 7ff784e4272e 25809->25812 25810->25808 25812->25660 25830 7ff784e45940 25812->25830 25814 7ff784e4586b 25815 7ff784e43a40 49 API calls 25814->25815 25817 7ff784e45884 25815->25817 25816 7ff784e484c0 3 API calls 25816->25814 25818 7ff784e458a9 25817->25818 25819 7ff784e45889 25817->25819 25883 7ff784e484c0 25818->25883 25820 7ff784e41e50 81 API calls 25819->25820 25820->25822 25822->25809 25823 7ff784e458b6 25824 7ff784e458c2 25823->25824 25825 7ff784e45901 25823->25825 25826 7ff784e48950 2 API calls 25824->25826 25888 7ff784e44c40 166 API calls 25825->25888 25828 7ff784e458da GetLastError 25826->25828 25887 7ff784e42310 80 API calls _log10_special 25828->25887 25889 7ff784e44810 25830->25889 25832 7ff784e45966 25833 7ff784e4596e 25832->25833 25834 7ff784e4597f 25832->25834 25835 7ff784e41e50 81 API calls 25833->25835 25896 7ff784e440a0 25834->25896 25841 7ff784e4597a 25835->25841 25838 7ff784e4599c 25842 7ff784e459ac 25838->25842 25844 7ff784e459bd 25838->25844 25839 7ff784e4598b 25840 7ff784e41e50 81 API calls 25839->25840 25840->25841 25841->25656 25843 7ff784e41e50 81 API calls 25842->25843 25843->25841 25845 7ff784e459ed 25844->25845 25846 7ff784e459dc 25844->25846 25848 7ff784e45a0d 25845->25848 25849 7ff784e459fc 25845->25849 25847 7ff784e41e50 81 API calls 25846->25847 25847->25841 25900 7ff784e44160 25848->25900 25850 7ff784e41e50 81 API calls 25849->25850 25850->25841 25853 7ff784e45a2d 25856 7ff784e45a4d 25853->25856 25857 7ff784e45a3c 25853->25857 25854 7ff784e45a1c 25855 7ff784e41e50 81 API calls 25854->25855 25855->25841 25859 7ff784e45a5f 25856->25859 25861 7ff784e45a70 25856->25861 25858 7ff784e41e50 81 API calls 25857->25858 25858->25841 25860 7ff784e41e50 81 API calls 25859->25860 25860->25841 25864 7ff784e45a9a 25861->25864 25914 7ff784e581ec 73 API calls 25861->25914 25863 7ff784e45a88 25915 7ff784e581ec 73 API calls 25863->25915 25864->25841 25865 7ff784e41e50 81 API calls 25864->25865 25865->25841 25868 7ff784e454b0 25867->25868 25868->25868 25869 7ff784e454d9 25868->25869 25874 7ff784e454f0 __vcrt_freefls 25868->25874 25870 7ff784e41e50 81 API calls 25869->25870 25871 7ff784e454e5 25870->25871 25871->25658 25873 7ff784e41e50 81 API calls 25873->25874 25874->25873 25875 7ff784e455fb 25874->25875 25917 7ff784e41450 25874->25917 25875->25658 25876->25660 25878 7ff784e4397a 25877->25878 25879 7ff784e48950 2 API calls 25878->25879 25880 7ff784e4399f 25879->25880 25881 7ff784e4bb10 _log10_special 8 API calls 25880->25881 25882 7ff784e439c7 25881->25882 25882->25814 25882->25816 25884 7ff784e48950 2 API calls 25883->25884 25885 7ff784e484d4 LoadLibraryExW 25884->25885 25886 7ff784e484f3 __vcrt_freefls 25885->25886 25886->25823 25887->25822 25888->25822 25891 7ff784e4483c 25889->25891 25890 7ff784e44844 25890->25832 25891->25890 25894 7ff784e449e4 25891->25894 25916 7ff784e57a64 48 API calls 25891->25916 25892 7ff784e44ba7 __vcrt_freefls 25892->25832 25893 7ff784e43be0 47 API calls 25893->25894 25894->25892 25894->25893 25897 7ff784e440d0 25896->25897 25898 7ff784e4bb10 _log10_special 8 API calls 25897->25898 25899 7ff784e4413a 25898->25899 25899->25838 25899->25839 25901 7ff784e44175 25900->25901 25902 7ff784e41c60 49 API calls 25901->25902 25903 7ff784e441c1 25902->25903 25904 7ff784e44243 __vcrt_freefls 25903->25904 25905 7ff784e41c60 49 API calls 25903->25905 25906 7ff784e4bb10 _log10_special 8 API calls 25904->25906 25908 7ff784e44200 25905->25908 25907 7ff784e4428e 25906->25907 25907->25853 25907->25854 25908->25904 25909 7ff784e48950 2 API calls 25908->25909 25910 7ff784e44216 25909->25910 25911 7ff784e48950 2 API calls 25910->25911 25912 7ff784e4422d 25911->25912 25913 7ff784e48950 2 API calls 25912->25913 25913->25904 25914->25863 25915->25864 25916->25891 25918 7ff784e439d0 108 API calls 25917->25918 25919 7ff784e41473 25918->25919 25920 7ff784e4149c 25919->25920 25921 7ff784e4147b 25919->25921 25923 7ff784e4fc2c 73 API calls 25920->25923 25922 7ff784e41e50 81 API calls 25921->25922 25924 7ff784e4148b 25922->25924 25925 7ff784e414b1 25923->25925 25924->25874 25926 7ff784e414b5 25925->25926 25927 7ff784e414d8 25925->25927 25969 7ff784e55e48 11 API calls _get_daylight 25926->25969 25931 7ff784e414e8 25927->25931 25932 7ff784e41512 25927->25932 25929 7ff784e414ba 25970 7ff784e42020 87 API calls _log10_special 25929->25970 25971 7ff784e55e48 11 API calls _get_daylight 25931->25971 25934 7ff784e41518 25932->25934 25942 7ff784e4152b 25932->25942 25947 7ff784e411f0 25934->25947 25935 7ff784e414f0 25972 7ff784e42020 87 API calls _log10_special 25935->25972 25938 7ff784e4f5a4 74 API calls 25941 7ff784e415a4 25938->25941 25939 7ff784e414d3 __vcrt_freefls 25939->25938 25940 7ff784e4f8f4 _fread_nolock 53 API calls 25940->25942 25941->25874 25942->25939 25942->25940 25943 7ff784e415b6 25942->25943 25973 7ff784e55e48 11 API calls _get_daylight 25943->25973 25945 7ff784e415bb 25974 7ff784e42020 87 API calls _log10_special 25945->25974 25948 7ff784e41248 25947->25948 25949 7ff784e41277 25948->25949 25950 7ff784e4124f 25948->25950 25953 7ff784e41291 25949->25953 25954 7ff784e412b4 25949->25954 25951 7ff784e41e50 81 API calls 25950->25951 25952 7ff784e41262 25951->25952 25952->25939 25975 7ff784e55e48 11 API calls _get_daylight 25953->25975 25958 7ff784e412c6 25954->25958 25967 7ff784e412e9 memcpy_s 25954->25967 25956 7ff784e41296 25976 7ff784e42020 87 API calls _log10_special 25956->25976 25977 7ff784e55e48 11 API calls _get_daylight 25958->25977 25960 7ff784e4f8f4 _fread_nolock 53 API calls 25960->25967 25961 7ff784e412cb 25978 7ff784e42020 87 API calls _log10_special 25961->25978 25963 7ff784e412af __vcrt_freefls 25963->25939 25964 7ff784e413af 25965 7ff784e41e50 81 API calls 25964->25965 25965->25963 25967->25960 25967->25963 25967->25964 25968 7ff784e4f668 37 API calls 25967->25968 25979 7ff784e50034 76 API calls 25967->25979 25968->25967 25969->25929 25970->25939 25971->25935 25972->25939 25973->25945 25974->25939 25975->25956 25976->25963 25977->25961 25978->25963 25979->25967 25980->25663 25983 7ff784e5591e 25981->25983 25982 7ff784e55943 25999 7ff784e5b758 37 API calls 2 library calls 25982->25999 25983->25982 25985 7ff784e5597f 25983->25985 26000 7ff784e527b8 49 API calls _invalid_parameter_noinfo 25985->26000 25987 7ff784e55a5c 25989 7ff784e5b464 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 25987->25989 25988 7ff784e55a16 25988->25987 25992 7ff784e55a80 25988->25992 25993 7ff784e55a31 25988->25993 25994 7ff784e55a28 25988->25994 25998 7ff784e5596d 25989->25998 25990 7ff784e4bb10 _log10_special 8 API calls 25991 7ff784e41ca8 25990->25991 25991->25401 25992->25987 25995 7ff784e55a8a 25992->25995 26001 7ff784e5b464 25993->26001 25994->25987 25994->25993 25997 7ff784e5b464 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 25995->25997 25997->25998 25998->25990 25999->25998 26000->25988 26002 7ff784e5b469 RtlFreeHeap 26001->26002 26003 7ff784e5b498 26001->26003 26002->26003 26004 7ff784e5b484 GetLastError 26002->26004 26003->25998 26005 7ff784e5b491 Concurrency::details::SchedulerProxy::DeleteThis 26004->26005 26007 7ff784e55e48 11 API calls _get_daylight 26005->26007 26007->26003 26010 7ff784e56e88 26008->26010 26009 7ff784e56eae 26039 7ff784e55e48 11 API calls _get_daylight 26009->26039 26010->26009 26013 7ff784e56ee1 26010->26013 26012 7ff784e56eb3 26040 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26012->26040 26015 7ff784e56ee7 26013->26015 26016 7ff784e56ef4 26013->26016 26041 7ff784e55e48 11 API calls _get_daylight 26015->26041 26027 7ff784e5bb30 26016->26027 26019 7ff784e43a26 26019->25678 26021 7ff784e56f08 26042 7ff784e55e48 11 API calls _get_daylight 26021->26042 26022 7ff784e56f15 26034 7ff784e6113c 26022->26034 26025 7ff784e56f28 26043 7ff784e562e8 LeaveCriticalSection 26025->26043 26044 7ff784e61548 EnterCriticalSection 26027->26044 26029 7ff784e5bb47 26030 7ff784e5bba4 19 API calls 26029->26030 26031 7ff784e5bb52 26030->26031 26032 7ff784e615a8 _isindst LeaveCriticalSection 26031->26032 26033 7ff784e56efe 26032->26033 26033->26021 26033->26022 26045 7ff784e60e38 26034->26045 26037 7ff784e61196 26037->26025 26039->26012 26040->26019 26041->26019 26042->26019 26051 7ff784e60e73 __vcrt_InitializeCriticalSectionEx 26045->26051 26046 7ff784e6103a 26050 7ff784e61043 26046->26050 26063 7ff784e55e48 11 API calls _get_daylight 26046->26063 26048 7ff784e61111 26064 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26048->26064 26050->26037 26057 7ff784e67fc4 26050->26057 26051->26046 26060 7ff784e58978 51 API calls 3 library calls 26051->26060 26053 7ff784e610a5 26053->26046 26061 7ff784e58978 51 API calls 3 library calls 26053->26061 26055 7ff784e610c4 26055->26046 26062 7ff784e58978 51 API calls 3 library calls 26055->26062 26065 7ff784e675c4 26057->26065 26060->26053 26061->26055 26062->26046 26063->26048 26064->26050 26066 7ff784e675db 26065->26066 26067 7ff784e675f9 26065->26067 26119 7ff784e55e48 11 API calls _get_daylight 26066->26119 26067->26066 26070 7ff784e67615 26067->26070 26069 7ff784e675e0 26120 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26069->26120 26076 7ff784e67bd4 26070->26076 26074 7ff784e675ec 26074->26037 26122 7ff784e67908 26076->26122 26079 7ff784e67c49 26154 7ff784e55e28 11 API calls _get_daylight 26079->26154 26080 7ff784e67c61 26142 7ff784e5945c 26080->26142 26092 7ff784e67640 26092->26074 26121 7ff784e59434 LeaveCriticalSection 26092->26121 26099 7ff784e67c4e 26155 7ff784e55e48 11 API calls _get_daylight 26099->26155 26119->26069 26120->26074 26123 7ff784e67934 26122->26123 26131 7ff784e6794e 26122->26131 26123->26131 26167 7ff784e55e48 11 API calls _get_daylight 26123->26167 26125 7ff784e67943 26168 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26125->26168 26127 7ff784e67a1d 26138 7ff784e67a7a 26127->26138 26173 7ff784e5aab0 37 API calls 2 library calls 26127->26173 26128 7ff784e679cc 26128->26127 26171 7ff784e55e48 11 API calls _get_daylight 26128->26171 26131->26128 26169 7ff784e55e48 11 API calls _get_daylight 26131->26169 26132 7ff784e67a76 26135 7ff784e67af8 26132->26135 26132->26138 26133 7ff784e67a12 26172 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26133->26172 26174 7ff784e5b844 17 API calls _isindst 26135->26174 26137 7ff784e679c1 26170 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26137->26170 26138->26079 26138->26080 26175 7ff784e61548 EnterCriticalSection 26142->26175 26154->26099 26155->26092 26167->26125 26168->26131 26169->26137 26170->26128 26171->26133 26172->26127 26173->26132 26177 7ff784e58834 26176->26177 26180 7ff784e58310 26177->26180 26179 7ff784e5884d 26179->25686 26181 7ff784e5832b 26180->26181 26182 7ff784e5835a 26180->26182 26191 7ff784e5b758 37 API calls 2 library calls 26181->26191 26190 7ff784e562dc EnterCriticalSection 26182->26190 26185 7ff784e5835f 26187 7ff784e5837c 38 API calls 26185->26187 26186 7ff784e5834b 26186->26179 26188 7ff784e5836b 26187->26188 26189 7ff784e562e8 _fread_nolock LeaveCriticalSection 26188->26189 26189->26186 26191->26186 26193 7ff784e4f39b 26192->26193 26194 7ff784e4f3c9 26192->26194 26203 7ff784e5b758 37 API calls 2 library calls 26193->26203 26197 7ff784e4f3bb 26194->26197 26202 7ff784e562dc EnterCriticalSection 26194->26202 26197->25692 26198 7ff784e4f3e0 26199 7ff784e4f3fc 72 API calls 26198->26199 26200 7ff784e4f3ec 26199->26200 26201 7ff784e562e8 _fread_nolock LeaveCriticalSection 26200->26201 26201->26197 26203->26197 26205 7ff784e41ccc 26204->26205 26206 7ff784e48950 2 API calls 26205->26206 26207 7ff784e41cf4 26206->26207 26208 7ff784e41cfe 26207->26208 26209 7ff784e41d19 26207->26209 26215 7ff784e41e00 26208->26215 26219 7ff784e41db0 78 API calls 26209->26219 26212 7ff784e41d17 26213 7ff784e4bb10 _log10_special 8 API calls 26212->26213 26214 7ff784e41d40 26213->26214 26214->25702 26216 7ff784e41e26 26215->26216 26220 7ff784e557a0 26216->26220 26218 7ff784e41e3c 26218->26212 26219->26212 26221 7ff784e557ca 26220->26221 26222 7ff784e55802 26221->26222 26224 7ff784e55835 26221->26224 26234 7ff784e5b758 37 API calls 2 library calls 26222->26234 26227 7ff784e500d8 26224->26227 26226 7ff784e5582b 26226->26218 26235 7ff784e562dc EnterCriticalSection 26227->26235 26229 7ff784e500f5 26230 7ff784e52178 76 API calls 26229->26230 26231 7ff784e500fe 26230->26231 26232 7ff784e562e8 _fread_nolock LeaveCriticalSection 26231->26232 26233 7ff784e50108 26232->26233 26233->26226 26234->26226 26236->25717 26349 7ffbaa651000 36 API calls 26350 7ffbaa652600 PyCapsule_GetPointer PyMem_Free 26351 7ffbaa654600 6 API calls 26290 7ff784e42480 26291 7ff784e42490 26290->26291 26292 7ff784e424cb 26291->26292 26293 7ff784e424e1 26291->26293 26294 7ff784e41e50 81 API calls 26292->26294 26295 7ff784e42501 26293->26295 26306 7ff784e42517 __vcrt_freefls 26293->26306 26298 7ff784e424d7 26294->26298 26296 7ff784e41e50 81 API calls 26295->26296 26296->26298 26297 7ff784e4bb10 _log10_special 8 API calls 26299 7ff784e4269a 26297->26299 26298->26297 26300 7ff784e41450 114 API calls 26300->26306 26301 7ff784e42706 26302 7ff784e41e50 81 API calls 26301->26302 26302->26298 26303 7ff784e41c60 49 API calls 26303->26306 26304 7ff784e426f0 26305 7ff784e41e50 81 API calls 26304->26305 26305->26298 26306->26298 26306->26300 26306->26301 26306->26303 26306->26304 26307 7ff784e426ca 26306->26307 26309 7ff784e426a7 26306->26309 26308 7ff784e41e50 81 API calls 26307->26308 26308->26298 26310 7ff784e41e50 81 API calls 26309->26310 26310->26298 26335 7ff784e47980 Sleep 26353 7ff784e47500 112 API calls 26354 7ff784e61500 7 API calls 26336 7ff784e4c380 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 26380 7ff784e56280 76 API calls Concurrency::details::SchedulerProxy::DeleteThis 26382 7ff784e49f43 12 API calls 26356 7ff784e646f0 GetProcessHeap 26357 7ff784e442f6 MultiByteToWideChar MultiByteToWideChar 26315 7ff784e4cdf0 10 API calls 2 library calls 26384 7ffbab7c1ac0 8 API calls 26359 7ffbaa6547dc 14 API calls 26385 7ff784e4ea58 37 API calls __std_exception_copy 26360 7ff784e62ae4 44 API calls 5 library calls 26257 7ff784e565e4 26258 7ff784e5661b 26257->26258 26259 7ff784e565fe 26257->26259 26258->26259 26261 7ff784e5662e CreateFileW 26258->26261 26282 7ff784e55e28 11 API calls _get_daylight 26259->26282 26263 7ff784e56698 26261->26263 26264 7ff784e56662 26261->26264 26262 7ff784e56603 26283 7ff784e55e48 11 API calls _get_daylight 26262->26283 26286 7ff784e56bc0 46 API calls 3 library calls 26263->26286 26285 7ff784e56738 59 API calls 3 library calls 26264->26285 26268 7ff784e5669d 26271 7ff784e566cc 26268->26271 26272 7ff784e566a1 26268->26272 26269 7ff784e5660b 26284 7ff784e5b824 37 API calls _invalid_parameter_noinfo 26269->26284 26270 7ff784e56670 26274 7ff784e5668d CloseHandle 26270->26274 26275 7ff784e56677 CloseHandle 26270->26275 26288 7ff784e56980 51 API calls 26271->26288 26287 7ff784e55dbc 11 API calls 2 library calls 26272->26287 26278 7ff784e56616 26274->26278 26275->26278 26279 7ff784e566d9 26289 7ff784e56abc 21 API calls _fread_nolock 26279->26289 26281 7ff784e566ab 26281->26278 26282->26262 26283->26269 26284->26278 26285->26270 26286->26268 26287->26281 26288->26279 26289->26281 26321 7ffbaa6546e8 _PyArg_BadArgument _PyUnicode_Ready PyType_IsSubtype PyUnicode_FromString 26323 7ff784e45fe0 49 API calls _log10_special 26386 7ff784e5d460 12 API calls 26324 7ff784e4c1e0 38 API calls 2 library calls 26361 7ffbaa652de4 _seh_filter_dll __scrt_release_startup_lock 26325 7ffbaa6526d0 PyModuleDef_Init 26326 7ffbaa6524d0 14 API calls 26388 7ff784e4ec4a 55 API calls 2 library calls 26389 7ff784e6be53 LeaveCriticalSection _fread_nolock 26362 7ff784e626d0 55 API calls 3 library calls 26364 7ff784e5acd0 11 API calls 26365 7ff784e604d0 FreeLibrary 26340 7ffbaa654b40 15 API calls 26341 7ff784e61b38 77 API calls 4 library calls 26328 7ffbaa6542bc 7 API calls 26329 7ff784e4cfb8 45 API calls 26367 7ffbaa6541c8 _PyArg_BadArgument _PyUnicode_Ready PyErr_Occurred PyLong_FromLong PyType_IsSubtype 26368 7ff784e460c0 10 API calls 26330 7ff784e68fc0 CloseHandle 26369 7ffbaa651fb0 13 API calls 26342 7ff784e6af2c 55 API calls _CreateFrameInfo 26343 7ff784e4c32a GetModuleHandleW __GetCurrentState 26344 7ffbaa65353a __scrt_dllmain_exception_filter 26373 7ff784e4c8b0 54 API calls 26332 7ffbaa651ea0 18 API calls 26391 7ffbaa65441c 15 API calls 26392 7ff784e4e818 59 API calls 5 library calls 26238 7ff784e5a899 26250 7ff784e5b358 26238->26250 26240 7ff784e5a89e 26241 7ff784e5a8c5 GetModuleHandleW 26240->26241 26242 7ff784e5a90f 26240->26242 26241->26242 26248 7ff784e5a8d2 26241->26248 26243 7ff784e5a79c 11 API calls 26242->26243 26244 7ff784e5a94b 26243->26244 26245 7ff784e5a952 26244->26245 26246 7ff784e5a968 11 API calls 26244->26246 26247 7ff784e5a964 26246->26247 26248->26242 26249 7ff784e5a9c0 GetModuleHandleExW GetProcAddress FreeLibrary 26248->26249 26249->26242 26255 7ff784e5c050 45 API calls 3 library calls 26250->26255 26252 7ff784e5b361 26256 7ff784e5b40c 45 API calls 2 library calls 26252->26256 26255->26252 26346 7ff784e62920 74 API calls 2 library calls

                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                      Function 00007FF784E67BD4 Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 473 7ff784e67bd4-7ff784e67c47 call 7ff784e67908 476 7ff784e67c49-7ff784e67c52 call 7ff784e55e28 473->476 477 7ff784e67c61-7ff784e67c6b call 7ff784e5945c 473->477 482 7ff784e67c55-7ff784e67c5c call 7ff784e55e48 476->482 483 7ff784e67c6d-7ff784e67c84 call 7ff784e55e28 call 7ff784e55e48 477->483 484 7ff784e67c86-7ff784e67cef CreateFileW 477->484 500 7ff784e67fa2-7ff784e67fc2 482->500 483->482 485 7ff784e67d6c-7ff784e67d77 GetFileType 484->485 486 7ff784e67cf1-7ff784e67cf7 484->486 493 7ff784e67dca-7ff784e67dd1 485->493 494 7ff784e67d79-7ff784e67db4 GetLastError call 7ff784e55dbc CloseHandle 485->494 490 7ff784e67d39-7ff784e67d67 GetLastError call 7ff784e55dbc 486->490 491 7ff784e67cf9-7ff784e67cfd 486->491 490->482 491->490 498 7ff784e67cff-7ff784e67d37 CreateFileW 491->498 496 7ff784e67dd9-7ff784e67ddc 493->496 497 7ff784e67dd3-7ff784e67dd7 493->497 494->482 508 7ff784e67dba-7ff784e67dc5 call 7ff784e55e48 494->508 503 7ff784e67de2-7ff784e67e37 call 7ff784e59374 496->503 504 7ff784e67dde 496->504 497->503 498->485 498->490 512 7ff784e67e39-7ff784e67e45 call 7ff784e67b10 503->512 513 7ff784e67e56-7ff784e67e87 call 7ff784e67688 503->513 504->503 508->482 512->513 520 7ff784e67e47 512->520 518 7ff784e67e8d-7ff784e67ecf 513->518 519 7ff784e67e89-7ff784e67e8b 513->519 522 7ff784e67ef1-7ff784e67efc 518->522 523 7ff784e67ed1-7ff784e67ed5 518->523 521 7ff784e67e49-7ff784e67e51 call 7ff784e5b9c8 519->521 520->521 521->500 525 7ff784e67fa0 522->525 526 7ff784e67f02-7ff784e67f06 522->526 523->522 524 7ff784e67ed7-7ff784e67eec 523->524 524->522 525->500 526->525 528 7ff784e67f0c-7ff784e67f51 CloseHandle CreateFileW 526->528 530 7ff784e67f53-7ff784e67f81 GetLastError call 7ff784e55dbc call 7ff784e5959c 528->530 531 7ff784e67f86-7ff784e67f9b 528->531 530->531 531->525
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                                      • Opcode ID: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                                                                                                                                                      • Instruction ID: 061da014ae747a17704f867552f663ac2785a1e9e154cf0241f2d3682e239b64
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f7d25cc6398c99507331e2d119a18c280b6cb5988aed80ed714a7f2df808d279
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E9C10072B28A4695EB10EF66C4C06BC7761FB49BA8FA10239DE2E97394DF78D051C310
                                                                                                                                                                                                      Function 00007FF784E48840 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                                                      • Opcode ID: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                                                                                                                                                      • Instruction ID: 5a676e4eb874e45ca49a4623d9f23d1476855069a722b01776043709c5f8fd55
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8bb1e00aee5117eaed99adb2432ba14ac7573cdfbb2fa81c580c042f8a510df
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 86F04426A1CA4186F7A09F65B499766B350FB84778FD44335DAAE02AD4DFBCD009CA10
                                                                                                                                                                                                      Function 00007FF784E41000 Relevance: 61.8, APIs: 3, Strings: 32, Instructions: 527COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                      • String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$hide-early$hide-late$minimize-early$minimize-late$pkg$pyi-contents-directory$pyi-hide-console$pyi-python-flag$pyi-runtime-tmpdir
                                                                                                                                                                                                      • API String ID: 2776309574-3325264605
                                                                                                                                                                                                      • Opcode ID: 8739316d19fec5833dddcb4ed6a9c69bea6f655fdfbaae2acb73f3f7f91b5299
                                                                                                                                                                                                      • Instruction ID: a641b1df1ad5fc17ec00e9e9bec43d665ba73469a1f342be55160a47e7f584a1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8739316d19fec5833dddcb4ed6a9c69bea6f655fdfbaae2acb73f3f7f91b5299
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 83427E21A0CA8291FA25BF33E4D42F9E751BF54780FE44132DA9E426D6EEACE545C370
                                                                                                                                                                                                      Function 00007FF784E41930 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 295 7ff784e41930-7ff784e4196b call 7ff784e439d0 298 7ff784e41c2e-7ff784e41c52 call 7ff784e4bb10 295->298 299 7ff784e41971-7ff784e419b1 call 7ff784e473d0 295->299 304 7ff784e419b7-7ff784e419c7 call 7ff784e4fc2c 299->304 305 7ff784e41c1b-7ff784e41c1e call 7ff784e4f5a4 299->305 310 7ff784e419c9-7ff784e419e3 call 7ff784e55e48 call 7ff784e42020 304->310 311 7ff784e419e8-7ff784e41a04 call 7ff784e4f8f4 304->311 309 7ff784e41c23-7ff784e41c2b 305->309 309->298 310->305 316 7ff784e41a06-7ff784e41a20 call 7ff784e55e48 call 7ff784e42020 311->316 317 7ff784e41a25-7ff784e41a3a call 7ff784e55e68 311->317 316->305 325 7ff784e41a3c-7ff784e41a56 call 7ff784e55e48 call 7ff784e42020 317->325 326 7ff784e41a5b-7ff784e41adc call 7ff784e41c60 * 2 call 7ff784e4fc2c 317->326 325->305 337 7ff784e41ae1-7ff784e41af4 call 7ff784e55e84 326->337 340 7ff784e41af6-7ff784e41b10 call 7ff784e55e48 call 7ff784e42020 337->340 341 7ff784e41b15-7ff784e41b2e call 7ff784e4f8f4 337->341 340->305 347 7ff784e41b30-7ff784e41b4a call 7ff784e55e48 call 7ff784e42020 341->347 348 7ff784e41b4f-7ff784e41b6b call 7ff784e4f668 341->348 347->305 355 7ff784e41b7e-7ff784e41b8c 348->355 356 7ff784e41b6d-7ff784e41b79 call 7ff784e41e50 348->356 355->305 359 7ff784e41b92-7ff784e41b99 355->359 356->305 361 7ff784e41ba1-7ff784e41ba7 359->361 362 7ff784e41ba9-7ff784e41bb6 361->362 363 7ff784e41bc0-7ff784e41bcf 361->363 364 7ff784e41bd1-7ff784e41bda 362->364 363->363 363->364 365 7ff784e41bdc-7ff784e41bdf 364->365 366 7ff784e41bef 364->366 365->366 367 7ff784e41be1-7ff784e41be4 365->367 368 7ff784e41bf1-7ff784e41c04 366->368 367->366 369 7ff784e41be6-7ff784e41be9 367->369 370 7ff784e41c0d-7ff784e41c19 368->370 371 7ff784e41c06 368->371 369->366 372 7ff784e41beb-7ff784e41bed 369->372 370->305 370->361 371->370 372->368
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E473D0: _fread_nolock.LIBCMT ref: 00007FF784E4747A
                                                                                                                                                                                                      • _fread_nolock.LIBCMT ref: 00007FF784E419FB
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42020: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF784E41B4A), ref: 00007FF784E42070
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _fread_nolock$CurrentProcess
                                                                                                                                                                                                      • String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2397952137-3497178890
                                                                                                                                                                                                      • Opcode ID: a6eb15e25109c9be1d150fdbc2d2c4a80b46c4edbabc4da88c1e35f3169f3860
                                                                                                                                                                                                      • Instruction ID: dcda2c30f0a3d87267a18805eea835f09dc8401e6758e2e25097fa9ed8861706
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a6eb15e25109c9be1d150fdbc2d2c4a80b46c4edbabc4da88c1e35f3169f3860
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B818F31A0CA8695EB10EF26D4C46B9E3A1FF88784FE44036D98D47789DEBCE545CB60
                                                                                                                                                                                                      Function 00007FF784E41450 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-3659356012
                                                                                                                                                                                                      • Opcode ID: 4ca91cee6f1f414fca2b39d528cd21216207367bbe8692ae1d2c42e947fc4157
                                                                                                                                                                                                      • Instruction ID: 24209b2a4859bb3ab73f035e92913d28c82bdb54248bf52471bc97a707499fb3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ca91cee6f1f414fca2b39d528cd21216207367bbe8692ae1d2c42e947fc4157
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80414C32A08A8295EE00FF3394856F9E391BF48794FE44432ED4D47A99DEBCE501C720
                                                                                                                                                                                                      Function 00007FF784E411F0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 536 7ff784e411f0-7ff784e4124d call 7ff784e4b340 539 7ff784e41277-7ff784e4128f call 7ff784e55e84 536->539 540 7ff784e4124f-7ff784e41276 call 7ff784e41e50 536->540 545 7ff784e41291-7ff784e412af call 7ff784e55e48 call 7ff784e42020 539->545 546 7ff784e412b4-7ff784e412c4 call 7ff784e55e84 539->546 558 7ff784e41419-7ff784e4144d call 7ff784e4b020 call 7ff784e55e70 * 2 545->558 552 7ff784e412e9-7ff784e412fb 546->552 553 7ff784e412c6-7ff784e412e4 call 7ff784e55e48 call 7ff784e42020 546->553 556 7ff784e41300-7ff784e4131d call 7ff784e4f8f4 552->556 553->558 561 7ff784e41322-7ff784e41325 556->561 564 7ff784e4132b-7ff784e41335 call 7ff784e4f668 561->564 565 7ff784e41411 561->565 564->565 572 7ff784e4133b-7ff784e41347 564->572 565->558 574 7ff784e41350-7ff784e41378 call 7ff784e49780 572->574 577 7ff784e4137a-7ff784e4137d 574->577 578 7ff784e413f6-7ff784e4140c call 7ff784e41e50 574->578 579 7ff784e413f1 577->579 580 7ff784e4137f-7ff784e41389 577->580 578->565 579->578 582 7ff784e4138b-7ff784e413a1 call 7ff784e50034 580->582 583 7ff784e413b4-7ff784e413b7 580->583 593 7ff784e413af-7ff784e413b2 582->593 594 7ff784e413a3-7ff784e413ad call 7ff784e4f668 582->594 584 7ff784e413ca-7ff784e413cf 583->584 585 7ff784e413b9-7ff784e413c7 call 7ff784e6b0a0 583->585 584->574 588 7ff784e413d5-7ff784e413d8 584->588 585->584 591 7ff784e413da-7ff784e413dd 588->591 592 7ff784e413ec-7ff784e413ef 588->592 591->578 595 7ff784e413df-7ff784e413e7 591->595 592->565 593->578 594->584 594->593 595->556
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-2813020118
                                                                                                                                                                                                      • Opcode ID: 37a3c5b9b76d3df587580b4fdf5a8eb5e36b800325cb86182cc5fd71f5371e01
                                                                                                                                                                                                      • Instruction ID: a23eff31c570ac3d538640844f82200504e93707fb086efb53c9211f20551f3a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37a3c5b9b76d3df587580b4fdf5a8eb5e36b800325cb86182cc5fd71f5371e01
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6151B622A08A8245EA60BF23A4843BAE391FF84794FE44535ED8D477D5EFBCE505C720
                                                                                                                                                                                                      Function 00007FF784E5FF7C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF784E60316,?,?,-00000018,00007FF784E5BC5B,?,?,?,00007FF784E5BB52,?,?,?,00007FF784E56EFE), ref: 00007FF784E600F8
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF784E60316,?,?,-00000018,00007FF784E5BC5B,?,?,?,00007FF784E5BB52,?,?,?,00007FF784E56EFE), ref: 00007FF784E60104
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                                      • Opcode ID: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                                                                                                                                                      • Instruction ID: 050010227f9f65227f984e52725a379e2fc910b4dd1ea93dd5ff19582a2f0b35
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d956f0b8ec152b18ca11aa0aed68125bebf2684d60339ba7369f52f17a1fcfe1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6415621B19A5251FA91EF27E880675A391BF08BA4FA54935CD0D87784FFFDE445C320
                                                                                                                                                                                                      Function 00007FF784E42A70 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,00007FF784E42BC5), ref: 00007FF784E42AA1
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E42BC5), ref: 00007FF784E42AAB
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42310: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E42360
                                                                                                                                                                                                        • Part of subcall function 00007FF784E42310: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E4241A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentErrorFileFormatLastMessageModuleNameProcess
                                                                                                                                                                                                      • String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
                                                                                                                                                                                                      • API String ID: 4002088556-2863816727
                                                                                                                                                                                                      • Opcode ID: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                                                                                                                                                      • Instruction ID: 37300d5d1d5eec170fd686da0764ca893e93483198482771c54cfde83af6e54a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 093d1e49c6a3f32bbd7db28c580ca23961d52f0e240546522d41da137270d6a4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1E217421B1CE4291FA60BF36E8943B6E351BF98394FE04132E54D865D5EEACE505C720
                                                                                                                                                                                                      Function 00007FF784E5C95C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 723 7ff784e5c95c-7ff784e5c982 724 7ff784e5c99d-7ff784e5c9a1 723->724 725 7ff784e5c984-7ff784e5c998 call 7ff784e55e28 call 7ff784e55e48 723->725 726 7ff784e5cd77-7ff784e5cd83 call 7ff784e55e28 call 7ff784e55e48 724->726 727 7ff784e5c9a7-7ff784e5c9ae 724->727 739 7ff784e5cd8e 725->739 746 7ff784e5cd89 call 7ff784e5b824 726->746 727->726 729 7ff784e5c9b4-7ff784e5c9e2 727->729 729->726 733 7ff784e5c9e8-7ff784e5c9ef 729->733 736 7ff784e5ca08-7ff784e5ca0b 733->736 737 7ff784e5c9f1-7ff784e5ca03 call 7ff784e55e28 call 7ff784e55e48 733->737 742 7ff784e5cd73-7ff784e5cd75 736->742 743 7ff784e5ca11-7ff784e5ca17 736->743 737->746 744 7ff784e5cd91-7ff784e5cda8 739->744 742->744 743->742 747 7ff784e5ca1d-7ff784e5ca20 743->747 746->739 747->737 750 7ff784e5ca22-7ff784e5ca47 747->750 752 7ff784e5ca7a-7ff784e5ca81 750->752 753 7ff784e5ca49-7ff784e5ca4b 750->753 756 7ff784e5ca83-7ff784e5caab call 7ff784e5e6c4 call 7ff784e5b464 * 2 752->756 757 7ff784e5ca56-7ff784e5ca6d call 7ff784e55e28 call 7ff784e55e48 call 7ff784e5b824 752->757 754 7ff784e5ca4d-7ff784e5ca54 753->754 755 7ff784e5ca72-7ff784e5ca78 753->755 754->755 754->757 759 7ff784e5caf8-7ff784e5cb0f 755->759 783 7ff784e5caad-7ff784e5cac3 call 7ff784e55e48 call 7ff784e55e28 756->783 784 7ff784e5cac8-7ff784e5caf3 call 7ff784e5d184 756->784 787 7ff784e5cc00 757->787 762 7ff784e5cb8a-7ff784e5cb94 call 7ff784e64b8c 759->762 763 7ff784e5cb11-7ff784e5cb19 759->763 774 7ff784e5cc1e 762->774 775 7ff784e5cb9a-7ff784e5cbaf 762->775 763->762 767 7ff784e5cb1b-7ff784e5cb1d 763->767 767->762 771 7ff784e5cb1f-7ff784e5cb35 767->771 771->762 776 7ff784e5cb37-7ff784e5cb43 771->776 779 7ff784e5cc23-7ff784e5cc43 ReadFile 774->779 775->774 781 7ff784e5cbb1-7ff784e5cbc3 GetConsoleMode 775->781 776->762 782 7ff784e5cb45-7ff784e5cb47 776->782 785 7ff784e5cd3d-7ff784e5cd46 GetLastError 779->785 786 7ff784e5cc49-7ff784e5cc51 779->786 781->774 788 7ff784e5cbc5-7ff784e5cbcd 781->788 782->762 789 7ff784e5cb49-7ff784e5cb61 782->789 783->787 784->759 795 7ff784e5cd48-7ff784e5cd5e call 7ff784e55e48 call 7ff784e55e28 785->795 796 7ff784e5cd63-7ff784e5cd66 785->796 786->785 792 7ff784e5cc57 786->792 797 7ff784e5cc03-7ff784e5cc0d call 7ff784e5b464 787->797 788->779 794 7ff784e5cbcf-7ff784e5cbf1 ReadConsoleW 788->794 789->762 790 7ff784e5cb63-7ff784e5cb6f 789->790 790->762 798 7ff784e5cb71-7ff784e5cb73 790->798 802 7ff784e5cc5e-7ff784e5cc73 792->802 804 7ff784e5cbf3 GetLastError 794->804 805 7ff784e5cc12-7ff784e5cc1c 794->805 795->787 799 7ff784e5cd6c-7ff784e5cd6e 796->799 800 7ff784e5cbf9-7ff784e5cbfb call 7ff784e55dbc 796->800 797->744 798->762 809 7ff784e5cb75-7ff784e5cb85 798->809 799->797 800->787 802->797 811 7ff784e5cc75-7ff784e5cc80 802->811 804->800 805->802 809->762 815 7ff784e5cca7-7ff784e5ccaf 811->815 816 7ff784e5cc82-7ff784e5cc9b call 7ff784e5c574 811->816 820 7ff784e5cd2b-7ff784e5cd38 call 7ff784e5c3b4 815->820 821 7ff784e5ccb1-7ff784e5ccc3 815->821 823 7ff784e5cca0-7ff784e5cca2 816->823 820->823 824 7ff784e5cd1e-7ff784e5cd26 821->824 825 7ff784e5ccc5 821->825 823->797 824->797 827 7ff784e5ccca-7ff784e5ccd1 825->827 828 7ff784e5cd0d-7ff784e5cd18 827->828 829 7ff784e5ccd3-7ff784e5ccd7 827->829 828->824 830 7ff784e5ccd9-7ff784e5cce0 829->830 831 7ff784e5ccf3 829->831 830->831 832 7ff784e5cce2-7ff784e5cce6 830->832 833 7ff784e5ccf9-7ff784e5cd09 831->833 832->831 834 7ff784e5cce8-7ff784e5ccf1 832->834 833->827 835 7ff784e5cd0b 833->835 834->833 835->824
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: eb536eff56005b26acab214ddad3b7f617f69f6ae0f39e6e286dc3f6b59ee020
                                                                                                                                                                                                      • Instruction ID: 01dc999b3a83e23055f5ac2cabf3fdf54dd7af1185050d0cfef494fc788c7d7d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eb536eff56005b26acab214ddad3b7f617f69f6ae0f39e6e286dc3f6b59ee020
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8FC1E43290CB8691E761AF1694D02BDEBA0FB81B90FE64131DA4E87795DEFCE445C720
                                                                                                                                                                                                      Function 00007FF784E457A0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
                                                                                                                                                                                                      • API String ID: 2050909247-2434346643
                                                                                                                                                                                                      • Opcode ID: 0161030ac6cb013b432a21c9304879e0f469f25312fd656d8e332880937228c1
                                                                                                                                                                                                      • Instruction ID: 64ec8a01529e5d00dc39335cc0a79e712aae80c86df72c7cad02fe0bc64b3ec2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0161030ac6cb013b432a21c9304879e0f469f25312fd656d8e332880937228c1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2C418331A18E8AA1EA10FF72E4841E9E315FB54794FE00532E65D436D6EFBCE605C760
                                                                                                                                                                                                      Function 00007FF784E5DE60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                      control_flow_graph 908 7ff784e5de60-7ff784e5de85 909 7ff784e5de8b-7ff784e5de8e 908->909 910 7ff784e5e153 908->910 911 7ff784e5dec7-7ff784e5def3 909->911 912 7ff784e5de90-7ff784e5dec2 call 7ff784e5b758 909->912 913 7ff784e5e155-7ff784e5e165 910->913 915 7ff784e5defe-7ff784e5df04 911->915 916 7ff784e5def5-7ff784e5defc 911->916 912->913 918 7ff784e5df14-7ff784e5df29 call 7ff784e64b8c 915->918 919 7ff784e5df06-7ff784e5df0f call 7ff784e5d220 915->919 916->912 916->915 923 7ff784e5e043-7ff784e5e04c 918->923 924 7ff784e5df2f-7ff784e5df38 918->924 919->918 925 7ff784e5e04e-7ff784e5e054 923->925 926 7ff784e5e0a0-7ff784e5e0c5 WriteFile 923->926 924->923 927 7ff784e5df3e-7ff784e5df42 924->927 930 7ff784e5e08c-7ff784e5e099 call 7ff784e5d918 925->930 931 7ff784e5e056-7ff784e5e059 925->931 928 7ff784e5e0c7-7ff784e5e0cd GetLastError 926->928 929 7ff784e5e0d0 926->929 932 7ff784e5df44-7ff784e5df4c call 7ff784e55270 927->932 933 7ff784e5df53-7ff784e5df5e 927->933 928->929 937 7ff784e5e0d3 929->937 944 7ff784e5e09e 930->944 938 7ff784e5e05b-7ff784e5e05e 931->938 939 7ff784e5e078-7ff784e5e08a call 7ff784e5db38 931->939 932->933 934 7ff784e5df60-7ff784e5df69 933->934 935 7ff784e5df6f-7ff784e5df84 GetConsoleMode 933->935 934->923 934->935 942 7ff784e5e03c 935->942 943 7ff784e5df8a-7ff784e5df90 935->943 945 7ff784e5e0d8 937->945 946 7ff784e5e0e4-7ff784e5e0ee 938->946 947 7ff784e5e064-7ff784e5e076 call 7ff784e5da1c 938->947 952 7ff784e5e030-7ff784e5e037 939->952 942->923 950 7ff784e5e019-7ff784e5e02b call 7ff784e5d4a0 943->950 951 7ff784e5df96-7ff784e5df99 943->951 944->952 953 7ff784e5e0dd 945->953 954 7ff784e5e14c-7ff784e5e151 946->954 955 7ff784e5e0f0-7ff784e5e0f5 946->955 947->952 950->952 958 7ff784e5df9b-7ff784e5df9e 951->958 959 7ff784e5dfa4-7ff784e5dfb2 951->959 952->945 953->946 954->913 960 7ff784e5e0f7-7ff784e5e0fa 955->960 961 7ff784e5e123-7ff784e5e12d 955->961 958->953 958->959 965 7ff784e5dfb4 959->965 966 7ff784e5e010-7ff784e5e014 959->966 967 7ff784e5e0fc-7ff784e5e10b 960->967 968 7ff784e5e113-7ff784e5e11e call 7ff784e55e04 960->968 963 7ff784e5e134-7ff784e5e143 961->963 964 7ff784e5e12f-7ff784e5e132 961->964 963->954 964->910 964->963 970 7ff784e5dfb8-7ff784e5dfcf call 7ff784e64c58 965->970 966->937 967->968 968->961 974 7ff784e5e007-7ff784e5e00d GetLastError 970->974 975 7ff784e5dfd1-7ff784e5dfdd 970->975 974->966 976 7ff784e5dffc-7ff784e5e003 975->976 977 7ff784e5dfdf-7ff784e5dff1 call 7ff784e64c58 975->977 976->966 978 7ff784e5e005 976->978 977->974 981 7ff784e5dff3-7ff784e5dffa 977->981 978->970 981->976
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E5DE4B), ref: 00007FF784E5DF7C
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF784E5DE4B), ref: 00007FF784E5E007
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                                      • Opcode ID: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                                                                                                                                                      • Instruction ID: 251a3bfaea5929ed6120b422c8ef9e6401220a7972c3b6d5c98bca3598b91dd2
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 25026d299ec132fa7e986de3a50f80dd4a1c565eb46710a002b358a032e27337
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E691F732F1865185F750AF6A94C16BDABA0BB04B88FB54139DE4E97B84DFBCE441C320
                                                                                                                                                                                                      Function 00007FF784E565E4 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1279662727-0
                                                                                                                                                                                                      • Opcode ID: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                                                                                                                                                      • Instruction ID: 6fe7c9c3453b7ede9958a06030b97ba378c9b75960c5f1eb8104c43334d1f32f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a7851f35165aa053145fe01894016aececa3f2381e8a001c745c02259ff3d92e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3741A222E1878283E754AF329590379B360FB95364F619734E69C43AD5DFECA1E0C720
                                                                                                                                                                                                      Function 00007FF784E41E50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF784E41B79), ref: 00007FF784E41E9E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: ERROR$[PYI-%d:%s]
                                                                                                                                                                                                      • API String ID: 2050909247-3005936843
                                                                                                                                                                                                      • Opcode ID: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                                                                                                                                                      • Instruction ID: 5f90ccfed1a629e1e8dc7885d5bc1c7e908c63647010913a0058877ea16caa6a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1c0bec23ccac853a0e083361079492e25c9a947d7081d13b76ea5259852d608
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6118E22618B8551EA20AF62B8856EAF364FB847C4F900135FA8D43A5ADEBCD255C710
                                                                                                                                                                                                      Function 00007FF784E5A968 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                      • Opcode ID: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
                                                                                                                                                                                                      • Instruction ID: bcf24dd4a92d90551637ab0fad22a5916be03a756117c4e8e7dd7f8b6f8fa5e4
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 823bef23182f8f61d7efa7880482c28a4a7867c446eada0463010af46261c3c5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01D09E10B0C71257EA243FB26CD567992517F98711FE21538C88F86397CDEDA449CA60
                                                                                                                                                                                                      Function 00007FF784E4F694 Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
                                                                                                                                                                                                      • Instruction ID: 76b8dc6642fdf21747f57a59fe8c5112ecd9f63f7a7e2649cf60a3844d6c905d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eff41cba983b05e0f9e09f52185aba8178b112ae95ee52c2a1f9a5fdd57fcc68
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A51C521B09A8546E664BE37948067AE391BF48FB4FA44734DE6C477D5CEBCE400C620
                                                                                                                                                                                                      Function 00007FF784E4C1FC Relevance: 3.1, APIs: 2, Instructions: 102COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1236291503-0
                                                                                                                                                                                                      • Opcode ID: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                                                                                                                                                      • Instruction ID: efa1afa077954c403d8534aabe0eb939e0cc1bbc0ca44bd00f397928e549857a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbbb43f9e1356fc36a8983c03ebcc8b7addcb0e166801d8c410c30bb16f29642
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A316C11E0CA4242FA64BF7795913B99391BF84784FE65035E94D876D7DEECB804C234
                                                                                                                                                                                                      Function 00007FF784E5D918 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 442123175-0
                                                                                                                                                                                                      • Opcode ID: 8ebc058675795335f9a47618937f9bde65187aaad64a1c6bbc7aea363135bb52
                                                                                                                                                                                                      • Instruction ID: 4c01e1bc77cc8ba31f4ba5f1aa3a849a2e4f8f2aacfe977db67b683cc11a9040
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8ebc058675795335f9a47618937f9bde65187aaad64a1c6bbc7aea363135bb52
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 83310632618B858AEB10AF26E4806E9B764FB58784FE58032DB8D83715EFBCD515C710
                                                                                                                                                                                                      Function 00007FF784E5D318 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileHandleType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3000768030-0
                                                                                                                                                                                                      • Opcode ID: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                                                                                                                                                      • Instruction ID: 41b1d0d5b4994015d1a68934c93fcb548392e5e0c67a07b281a2085a95f9a834
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b01a8b1655aeb6f71db35254c5ecf6a703e147159c44eee076082fbba724bcfb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 21319521A18B4691EB60AF1685C057DA650FB45BB0FB55339DBAE873E0CF7CE461D310
                                                                                                                                                                                                      Function 00007FF784E5D034 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF784E5D020,?,?,?,?,?,00007FF784E5D129), ref: 00007FF784E5D080
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,00007FF784E5D020,?,?,?,?,?,00007FF784E5D129), ref: 00007FF784E5D08A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastPointer
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2976181284-0
                                                                                                                                                                                                      • Opcode ID: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                                                                                                                                                      • Instruction ID: 0977229599fade3dbd9181320dcf17940316df172bcdf2ad084e2b1e35ae5835
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fb6a81950565da05b050a92576ed7c02e19ce8787ed1f1a96796d90f6b6408b2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6411C461608B8181DA10AF26B484069E762FB44FF4FA44331EEBD8B7E9DEBCD055C754
                                                                                                                                                                                                      Function 00007FF784E5B464 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFreeHeapLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 485612231-0
                                                                                                                                                                                                      • Opcode ID: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                                                                                                                                                      • Instruction ID: 4d859fde1128efcbdee5a7978eaca840a8a66571161b7e4bbd5699afef145c7a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bcb6ed366288f57e679071cac10841f4f6d99062b1a4c36b0c72b5ea8c3cbe48
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 58E08C51F0CA0686FF297FF3A8C4038D1617F98740FE14034CA0D86262EEAC6885C330
                                                                                                                                                                                                      Function 00007FF784E5BA60 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CloseHandle.KERNELBASE(?,?,?,00007FF784E5B8DD,?,?,00000000,00007FF784E5B992), ref: 00007FF784E5BACE
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E5B8DD,?,?,00000000,00007FF784E5B992), ref: 00007FF784E5BAD8
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CloseErrorHandleLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 918212764-0
                                                                                                                                                                                                      • Opcode ID: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                                                                                                                                                      • Instruction ID: 1e5ebbbbf8fc829e3d94d43c4f20d7f47d3bde2fb587b86a9ea32fb3b24dec37
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ee1f6f2c17bcac9912aebe9a75d3c59e1af1689cfc13c1c78b5a219ca8e97850
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8A21A720B0C68245FE507F23A5D02BD92817F547A4FE64235EA6EC77C6DEECA445C320
                                                                                                                                                                                                      Function 00007FF784E5CDAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
                                                                                                                                                                                                      • Instruction ID: 976e9cb1c4115ad619679ef7eaa818e8ce680f78774be671e167e1e23b41faeb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ca67b63ad487b7dd06d77dc7b625cd7cf40d94e9b0d9a023c4747a6b48452177
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B41B13290824587EA24AF1AE59027DF7A0FB59B44FA11131DA8EC7A91CFBDE402D761
                                                                                                                                                                                                      Function 00007FF784E473D0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _fread_nolock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 840049012-0
                                                                                                                                                                                                      • Opcode ID: 3e00be972b076664415c34287f2c081789fdb96c9513fff431a7afc3c45257cd
                                                                                                                                                                                                      • Instruction ID: f6055b1e5cdafaea44dc165fee330da226b4745cd0468ea1622b76e908e1ea3e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3e00be972b076664415c34287f2c081789fdb96c9513fff431a7afc3c45257cd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37218021B08A9245EA10BE2365843BADB41BF45BD8FE94430EE4D4B786CEBCE042C360
                                                                                                                                                                                                      Function 00007FF784E5C83C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
                                                                                                                                                                                                      • Instruction ID: 55a7e646a259de535d4e7aff44001ab53320c48cbd037f57319552c34b713158
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 253ecda3210493d2f26eb4f52b5119aed9cb222ec82c37949b93d1e134238cda
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AC316932A1CA4685F6117F5698D13BCA690BF44BA4FE20135EA2D873D2DEFCA441C771
                                                                                                                                                                                                      Function 00007FF784E5A899 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3947729631-0
                                                                                                                                                                                                      • Opcode ID: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
                                                                                                                                                                                                      • Instruction ID: 37e9a087edecc467e6f2d1d0b5401eea29b585735f6ec77c68a2d0043c7ca011
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 78c35fc7c6e2b8000ddfa863f9affaf41ca53d2f0572e0ba78e1a207ed009a92
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6721B232E047158AEB24AFA5D4802FC73A0FB04318FA60635D76D87AC5EFB8D644C760
                                                                                                                                                                                                      Function 00007FF784E56F54 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                                                                                                                                                      • Instruction ID: 5e8ef822cc53a71ce1638ff2d8650fc1b96608f4ba932b2d7003fb61fb48c4f6
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0e1df9a836e05c53306103cf914f9f5afd0b17d2d4247778ac0f8a736a470cc7
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23118722A1D64181EA61BF63D48027DE360BF55B80FE64031EB4C97B9ACFBCD551C760
                                                                                                                                                                                                      Function 00007FF784E675C4 Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                                                                                                                                                      • Instruction ID: cbd2afd20367d0553b0c76f85b917752e8ef6687b5ede25ca922c17e5a19890a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 705a0604598582430d769309be7d52bb613e0b4e097a3a0cc12fb03a34ef158b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EF219572A18A8297DB61AF19D4C0379B6A1FB84B94FB44234E65D876D9DF7CD400CB10
                                                                                                                                                                                                      Function 00007FF784E4F914 Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                      • Opcode ID: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                                                                                                                                                      • Instruction ID: 81a08b3300cd5d92c1ce8069e820b19ce5e27cd8ef565af115525640cd6a2347
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43297e0cb54a728217cf8f13d9f8c23c45e2da10c33361e46a2ef0799771412d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4C01A121A08B4240EA04AFA39840079E794BF95FE4FA84631DF6C57BDADEBCE401C310
                                                                                                                                                                                                      Function 00007FF784E4C3DC Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF784E4C3F0
                                                                                                                                                                                                        • Part of subcall function 00007FF784E4CE18: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF784E4CE20
                                                                                                                                                                                                        • Part of subcall function 00007FF784E4CE18: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF784E4CE25
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1208906642-0
                                                                                                                                                                                                      • Opcode ID: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                                                                                                                                                      • Instruction ID: 477f747081680ce65938f5a43f402049da3be257f50f22ee7caa2dff1b37617d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ececd82fc3177ae58a022cdb863293519d79894eaec9217f5cc72d6a823b184f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8E09210D0DA4285FE643E7315C62B987407F29348FF214B4D94DA3187EECD3556E132
                                                                                                                                                                                                      Function 00007FF784E484C0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E48950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF784E43A04,00000000,00007FF784E41965), ref: 00007FF784E48989
                                                                                                                                                                                                      • LoadLibraryExW.KERNELBASE(?,00007FF784E458B6,00000000,00007FF784E4272E), ref: 00007FF784E484E2
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2592636585-0
                                                                                                                                                                                                      • Opcode ID: eecf05ac3c5f30bf08fc7dde121322ed098c6ddca33d1bd86d5e57f6ee1af4d2
                                                                                                                                                                                                      • Instruction ID: 51ece6c5230a31ce014946eb47d90a92eaf6889636135b3d2a32e8a7bf7d34fd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: eecf05ac3c5f30bf08fc7dde121322ed098c6ddca33d1bd86d5e57f6ee1af4d2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8BD0CD12F2454541EE44BB777985539D1527F89BC0ED88035DE4C43B55DC3CD0518B00
                                                                                                                                                                                                      Function 00007FF784E5E6C4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • HeapAlloc.KERNEL32(?,?,?,00007FF784E50268,?,?,?,00007FF784E518D2,?,?,?,?,?,00007FF784E54595), ref: 00007FF784E5E702
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AllocHeap
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4292702814-0
                                                                                                                                                                                                      • Opcode ID: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                                                                                                                                                      • Instruction ID: ce0a128bb3ee3c9e3326de9eddd4c58ba98e077302ca3d18c7da1719007fdb20
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c4f21c11c5720e62b677d9e99b1ce174dfbed18f849e52640c9a6f6ea7657029
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 07F05811A1C24641FE683FA75982279D2807F54BA0FEA0630E92EC62C1EEECA480C630

                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                      Function 00007FF784E48020 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257synchronizationwindowregistryCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorLastMessage$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
                                                                                                                                                                                                      • String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
                                                                                                                                                                                                      • API String ID: 4208240515-3165540532
                                                                                                                                                                                                      • Opcode ID: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                                                                                                                                                      • Instruction ID: 07079263e527c2ce5737448bf39f26e97610e90005334543b0a6b5a8b54aa997
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 40a2b2c96db5062fbaff54aa02804a1320958b809a954de9be60782f8870c354
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C4D18432A08F8296EB10AF76E8906BDB764FF94B58FE00235DA5D42A94DFBCD544C710
                                                                                                                                                                                                      Function 00007FFBAA6518A0 Relevance: 13.9, APIs: 9, Instructions: 425COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Mem_$SubtypeType_$DataFreeFromKindMallocReallocUnicode_
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1742244024-0
                                                                                                                                                                                                      • Opcode ID: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
                                                                                                                                                                                                      • Instruction ID: 78016cb2983d63613d1aee9598d8caaa55d0256c115b076eb8f21f0f02787c2c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d17a493920b6b36c6fa0658f81e569c9b995c639d436fc25a26417b6e17d25f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DB0233F2A0E583C2E7268B3DDC6467937A9EB40F40F146175DE8E46790EE2DE442CB20
                                                                                                                                                                                                      Function 00007FFBAA653058 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 313767242-0
                                                                                                                                                                                                      • Opcode ID: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                      • Instruction ID: 69d8749f45e4e3ac0d995b8d0bd11d95805053b42ed20e6b3b72cef7e4f61054
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d5821aaf4936ad9aa18e348792a4e6496cc638c229f42c96d8f2983ca85ed40f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E73150B260AB82C5EB618F74E8543EE73A8FB84B44F44503ADA4E47B94DF39D549CB10
                                                                                                                                                                                                      Function 00007FF784E47800 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
                                                                                                                                                                                                      • String ID: %s\*
                                                                                                                                                                                                      • API String ID: 1057558799-766152087
                                                                                                                                                                                                      • Opcode ID: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                                                                                                                                                      • Instruction ID: 497e0301f1698f7d6294fb3d9a769f6afd0ade1a7ae9db4c7cca662515a396d9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 33e10a2293b6f66987fc751628de3762a02ba3a339ba911e57677f2f560f8a7f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 87419431A0CD8291EA70BF76E4C42B9A361FB94754FE00632D69D43694DFBCE646C750
                                                                                                                                                                                                      Function 00007FFBAB7C3A38 Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1584470717.00007FFBAB7B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFBAB7B0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584440650.00007FFBAB7B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584521250.00007FFBAB7C5000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbab7b0000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                                      • Opcode ID: aeed689daf0c74da142610712cb1a2bd475157229ecc2e661e3a7ba860125a9a
                                                                                                                                                                                                      • Instruction ID: 2effaaffa75376355717c5befb2586c3252eabff571399ddede1f0b217bbf0e1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: aeed689daf0c74da142610712cb1a2bd475157229ecc2e661e3a7ba860125a9a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EF316DB2619B818AEB619F70E8403EE3360FB85744F40803ADA5E47BA4EF7DC548C710
                                                                                                                                                                                                      Function 00007FF784E4C6FC Relevance: 10.6, APIs: 7, Instructions: 71COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                                      • Opcode ID: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                                                                                                                                                      • Instruction ID: 9586e9e8619aedb7928a363e3b39e48c39d9a86087b491d66dda1200b3ef9b9d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 89357c2c4ffda8ae13225540be7c458f51fcd4783b393db7419e501aec0a0031
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51314372609B8196EB60AF61E8807EDB364FB84744F94413ADA8D47B94DFB8D548C720
                                                                                                                                                                                                      Function 00007FF784E66E70 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E66EB5
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6681C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B844: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF784E5B823,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5B84D
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B844: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF784E5B823,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5B872
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E66EA4
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6687C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6711A
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6712B
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6713C
                                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF784E6737C), ref: 00007FF784E67163
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4070488512-0
                                                                                                                                                                                                      • Opcode ID: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
                                                                                                                                                                                                      • Instruction ID: 167c66165dd09d9198aa91666655782f9e8bdbf1b279af7cbea08054e5960c28
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0173cbac813c15378d40c9e56499cd14d87a7a7d5cd8bcf6202161c05a5fa724
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 23D1CF66A1824296EB20FF37D8C01B9E7A1FF94794FE04136EA0D47696DEBCE441C760
                                                                                                                                                                                                      Function 00007FF784E5B558 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                                      • Opcode ID: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                                                                                                                                                      • Instruction ID: 99962375f9e4bb9e1d7dd6f498e3d83d3a32419b60a96cfec58af3daf0b89080
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2c2a6f2487acec397f330098253e2a7329acffa396285c7b3dfee245a17751bc
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3731B832608F8196DB60DF26E8807ADB3A4FB98754FA00535EA9D43B54DFBCD145CB10
                                                                                                                                                                                                      Function 00007FF784E62AE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2227656907-0
                                                                                                                                                                                                      • Opcode ID: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
                                                                                                                                                                                                      • Instruction ID: 94b1b93f16478aabcac2d51ff9c99aa84dcc9c6c2f93d6fb0a3505e875f11a8d
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b6a193d294c3b32593d30be4cab4f407475a0a4c133e91729be199528772a0a4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 45B1D522B1869251EE61BF23D8802B9E361FB54BE4FA45132EE5E47BD5DEBCE441C310
                                                                                                                                                                                                      Function 00007FF784E670EC Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6711A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6687C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6712B
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66808: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6681C
                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF784E6713C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E66838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E6684C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF784E6737C), ref: 00007FF784E67163
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3458911817-0
                                                                                                                                                                                                      • Opcode ID: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
                                                                                                                                                                                                      • Instruction ID: 39ba1427573d3c933c59519741608881290d0cd92d7ba627972cf178edb01c19
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f3046009ef5eb4ee2f9f04adf13bbb5e89ae69c332d55b3385a3975d24ee77c8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C6516D72A1864296E720FF23E8C05B9E761BF58784FE04135EA4D47696DFBCE400C760
                                                                                                                                                                                                      Function 00007FF784E44C40 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C50
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C62
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44C99
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CAB
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CC4
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CD6
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44CEF
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D01
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D1D
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D2F
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D4B
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D5D
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D79
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44D8B
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DA7
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DB9
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DD5
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF784E4590F,00000000,00007FF784E4272E), ref: 00007FF784E44DE7
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorLastProc
                                                                                                                                                                                                      • String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                      • API String ID: 199729137-653951865
                                                                                                                                                                                                      • Opcode ID: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                                                                                                                                                      • Instruction ID: b83f00f344df2a699ab663129ccdbad8239521ab33ece0f21282446e12770d80
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 91fe38e706475bc85e8e17d1603b2dd44d209342b91b11e5c33006422c226cfa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F8229F24A0DF07A1FE54BF6BB8C45B4A3A1BF48745FE81436D84E016A4EFBCB549C220
                                                                                                                                                                                                      Function 00007FF784E46B00 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressErrorLastProc
                                                                                                                                                                                                      • String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                      • API String ID: 199729137-3427451314
                                                                                                                                                                                                      • Opcode ID: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                                                                                                                                                      • Instruction ID: fd6ed9d898bb06d77fdc5fc1f9b5c5a551aa18d20b2c12d86805d82f09595b92
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3ce57ac688b021c07c17bb9d18c3d2db368ff9ca427b7eb3b8bd4dc412038eb8
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2102A264A0DF47A0FA55BF67B8D45B4A3A2BF08745FF41136C84E062A5EFBCA549C230
                                                                                                                                                                                                      Function 00007FF784E47610 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E48950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF784E43A04,00000000,00007FF784E41965), ref: 00007FF784E48989
                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF784E47CF7,FFFFFFFF,00000000,?,00007FF784E43101), ref: 00007FF784E4766C
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                                                                      • String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
                                                                                                                                                                                                      • API String ID: 2001182103-930877121
                                                                                                                                                                                                      • Opcode ID: 05e9d80de81bbecbdcf4877121e92809571f96fe9b42699afcbc898c35f620e6
                                                                                                                                                                                                      • Instruction ID: 9029889422f078b30c55609883ad64b062bf2269c24c95d99c365db933a911fc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 05e9d80de81bbecbdcf4877121e92809571f96fe9b42699afcbc898c35f620e6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C516421A2CE4251FB50BF37E8D56BAE351FF94780FE40432DA4E42695EEACE504C7A0
                                                                                                                                                                                                      Function 00007FF784E415E0 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-1550345328
                                                                                                                                                                                                      • Opcode ID: 4932ec8326ed6d9f358ca1eefba92816a2ca99b9b5f7489fe0c5bd274eda6d1d
                                                                                                                                                                                                      • Instruction ID: 224ddbf74b104bc640be47c58ff5372aa3e3a6e00a90a7114a1f7b84ec45a1ce
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4932ec8326ed6d9f358ca1eefba92816a2ca99b9b5f7489fe0c5bd274eda6d1d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1519D21B0CA8792EA10BF23A4945B9E390BF44B94FE44532EE4C47B96DEBCF545C720
                                                                                                                                                                                                      Function 00007FFBAA6548C8 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 94COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Unicode_$CompareString$With$DeallocErr_Ready
                                                                                                                                                                                                      • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                      • API String ID: 1067165228-3528878251
                                                                                                                                                                                                      • Opcode ID: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
                                                                                                                                                                                                      • Instruction ID: ed8fa80212bc7632c3a2ff50d93a8e98694b6d3ce7381231b1f924f4e0403066
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a97fda713efcdaed74d0f15b89fc759eef65b993e3755085a36f180e1a2a6872
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3F4161A1A4E743C5EA628B3AEC483396359BF45F84F8461B9CD4E47794DF3DE0069B20
                                                                                                                                                                                                      Function 00007FFBAA6524D0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 73COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Module_$Dealloc$ObjectObject_$Capsule_ConstantFromMallocMem_SpecStringTrackTypeType_
                                                                                                                                                                                                      • String ID: 14.0.0$_ucnhash_CAPI$ucd_3_2_0$unidata_version
                                                                                                                                                                                                      • API String ID: 288921926-1430584071
                                                                                                                                                                                                      • Opcode ID: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
                                                                                                                                                                                                      • Instruction ID: 3ea99a89c907f2ca1162aecd17105dbb3f111b93c9535285840b8137a0952da0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 34ac006824e125b38f87d2d071ae01d9c336cf72669efd439cdbfbf994d14880
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5921FDE1E1A703C1FA175B3AEC242792698AF49F91F4460B5DE0E46654DF2DE4068B30
                                                                                                                                                                                                      Function 00007FFBAA651090 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 150COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CompareStringUnicode_With$Mem_$FreeMallocSubtypeType_
                                                                                                                                                                                                      • String ID: NFC$NFD$NFKC$NFKD$invalid normalization form
                                                                                                                                                                                                      • API String ID: 1723213316-3528878251
                                                                                                                                                                                                      • Opcode ID: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
                                                                                                                                                                                                      • Instruction ID: 3713b23b36ff9365551b5d767bcad5330aa48139ee59bd42f2aac5d9049b36d3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c1d1483b359176232031dcda17eceefdd4cd98cc21702f49892afc3e67e82068
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B0518EA5E0E253C1FA769B3AEC1467A5658AF52FC0F0460B5CD5F07B81CE2DE4038B20
                                                                                                                                                                                                      Function 00007FF784E47500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: LongWindow$BlockCreateErrorLastReasonShutdown
                                                                                                                                                                                                      • String ID: Needs to remove its temporary files.
                                                                                                                                                                                                      • API String ID: 3975851968-2863640275
                                                                                                                                                                                                      • Opcode ID: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                                                                                                                                                      • Instruction ID: 68f14960e5e4e397aec13b0ae41dec5a9328472392b8d77af9ba6bf217baa002
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 44e53fe94581f3919e9549e222624ce8134aca65504236f29db41f4538cf5799
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C421A361F0CE4292E751AF7BA8C4579A351FF88BA0FE84230DE5D87394DEACD580C220
                                                                                                                                                                                                      Function 00007FFBAA654600 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 62COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_Unicode_$ArgumentCheckDigitErr_PositionalReadyString
                                                                                                                                                                                                      • String ID: a unicode character$argument 1$digit$not a digit
                                                                                                                                                                                                      • API String ID: 3305933226-4278345224
                                                                                                                                                                                                      • Opcode ID: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
                                                                                                                                                                                                      • Instruction ID: e43f0ad9f559dde0f21d61589c05002d1392a5e538c4d680ca52ee20d0fd9c88
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f3312c4d2492d42c6bf8c5b24e15dccd6aa38fe551f57dd252bb694573ee7750
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A0215CA1E0AA43D1EB528B39DC4837923A9BF44F88F5464B5CE0E47664DF2DE447CB20
                                                                                                                                                                                                      Function 00007FFBAA652730 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 349153199-0
                                                                                                                                                                                                      • Opcode ID: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                      • Instruction ID: e40e8b5a22e09190ddb5a2c03cb37b8869aac6c3137d0af6959fb880be1c5358
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5ae4ae1fad975d5487a8dd9099fd26104a61e4c8513e68d9fc499fd676c40ec1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 27817AA1E0A243C6FA57AB7EDC412792298AF45F80F5461B9DD4C43796DE3CE8478F20
                                                                                                                                                                                                      Function 00007FFBAA651000 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Unicode_$Arg_$ArgumentCompareReadyStringWith$CheckPositionalSubtypeType_
                                                                                                                                                                                                      • String ID: argument 1$argument 2$normalize$str
                                                                                                                                                                                                      • API String ID: 3621440800-1320425463
                                                                                                                                                                                                      • Opcode ID: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                      • Instruction ID: d1916a25bbf134a17e8b24194e7516b2c56d6e31fe2b3665021e3b1644f31546
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94348148c340fa5468beab9ef1746397c69e42e894d14843631ab3fa4ea44381
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E021D7E0A1A687C0E7528B3DDC482792358AF04F98F5461B6DE1E472E4CF2CE447CB20
                                                                                                                                                                                                      Function 00007FFBAA6547DC Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_$ArgumentReadyUnicode_$CheckPositional
                                                                                                                                                                                                      • String ID: argument 1$argument 2$is_normalized$str
                                                                                                                                                                                                      • API String ID: 396090033-184702317
                                                                                                                                                                                                      • Opcode ID: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
                                                                                                                                                                                                      • Instruction ID: 9b5941bfffea1b82069a2e7ef143ba8da9618b2ea2521627cb714f29bc468579
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c961abb42e83fbff4e8e9473619491438f798cfd5e47330d0c83c04a8f602896
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9821C3A0E09A87C0E7568B39EC483752759AF04F98F4462F5CD6E072A4CF2CE447CB20
                                                                                                                                                                                                      Function 00007FFBAB7B3500 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 19COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1584470717.00007FFBAB7B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFBAB7B0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584440650.00007FFBAB7B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584521250.00007FFBAB7C5000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbab7b0000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: fprintf
                                                                                                                                                                                                      • String ID: %U%U%s$%U.%U$None$__module__$__qualname__$builtins$fatal: out of memory$tuple[<%d items>]
                                                                                                                                                                                                      • API String ID: 383729395-2533303582
                                                                                                                                                                                                      • Opcode ID: 8259fbac6288e7e894628dd3059eb3b8ff1b2303959a5ac55f8e6846b2142605
                                                                                                                                                                                                      • Instruction ID: ddf1c98ec1db4899d9ea9dba0376943defa1c15f0fe324dd38add6df572c5d5f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8259fbac6288e7e894628dd3059eb3b8ff1b2303959a5ac55f8e6846b2142605
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BED09BF0E1750247E7466771E86F2751225BF46743F40943CDD2F06375DE9D54445351
                                                                                                                                                                                                      Function 00007FFBAB7C3130 Relevance: 15.2, APIs: 10, Instructions: 227COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1584470717.00007FFBAB7B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFBAB7B0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584440650.00007FFBAB7B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584521250.00007FFBAB7C5000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbab7b0000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 190073905-0
                                                                                                                                                                                                      • Opcode ID: 66029f4771074ade3c580ea29c38b34b14212a0eafc25763c9365c1761447157
                                                                                                                                                                                                      • Instruction ID: 499f502b52b05e04080ebe259b400c42fb26c29bf5b5f8a51b4bc952d3408a30
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 66029f4771074ade3c580ea29c38b34b14212a0eafc25763c9365c1761447157
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C81C0E0E0E64386FA52AB75D4422BA6290BF47781F56C03DDD2D473B6DEBCE9458300
                                                                                                                                                                                                      Function 00007FF784E57250 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 493COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: -$:$f$p$p
                                                                                                                                                                                                      • API String ID: 3215553584-2013873522
                                                                                                                                                                                                      • Opcode ID: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                                                                                                                                                      • Instruction ID: a4b86297f808199d8bacac01fff60c56aa246dc7214c479060a2a49211234cc1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 65d4a0ffdc8e7253b8e60b637b85ac8f97459ea152ba9c8238927d2e88e0f15e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0812A462E0C15386FB207F16E0C4679F691FB40750FE64536E69A86AC4DFBCE4A0CB20
                                                                                                                                                                                                      Function 00007FF784E505A0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: f$f$p$p$f
                                                                                                                                                                                                      • API String ID: 3215553584-1325933183
                                                                                                                                                                                                      • Opcode ID: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                                                                                                                                                      • Instruction ID: 24f71e289ce6bb4a884ac80f17c9e63742927df62e0e4d0a0fbd6d4dfcb0057b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fc8e2330ab6ced16bd3d959f6bc8057a9fc686b659d09149717256120edd57c1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72126462A0D143C5FB64BE16D0D46B9F2A1FB90754FE54035F68A866C5EFBCE480CB20
                                                                                                                                                                                                      Function 00007FF784E41030 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                      • API String ID: 2050909247-3659356012
                                                                                                                                                                                                      • Opcode ID: 6921760146a0c1cba59389624a16484702c851259aa84d8018ffa26a0eb043f5
                                                                                                                                                                                                      • Instruction ID: c02f4f3be71f034a109405f4668edbb52ab4b33c36c8de68bff571d0151b00d0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6921760146a0c1cba59389624a16484702c851259aa84d8018ffa26a0eb043f5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B416022B0CA9295EA00FF2398886B9E391BF44BD4FE44532ED4D47796DEBCE505C760
                                                                                                                                                                                                      Function 00007FF784E47CA0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetTempPathW.KERNEL32(FFFFFFFF,00000000,?,00007FF784E43101), ref: 00007FF784E47D44
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,00007FF784E43101), ref: 00007FF784E47D4A
                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(?,00007FF784E43101), ref: 00007FF784E47D8C
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47E70: GetEnvironmentVariableW.KERNEL32(00007FF784E42C4F), ref: 00007FF784E47EA7
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47E70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF784E47EC9
                                                                                                                                                                                                        • Part of subcall function 00007FF784E59174: _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E5918D
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Environment$CreateCurrentDirectoryExpandPathProcessStringsTempVariable_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
                                                                                                                                                                                                      • API String ID: 365913792-1339014028
                                                                                                                                                                                                      • Opcode ID: 1fb38170b1a978031a49490dc65a9dc4b606e67260ee874af2bfd0bf0132ec29
                                                                                                                                                                                                      • Instruction ID: e23c315129d5401b667c29b37c96fab67ea3ad66f106b9c050ae5632edd88735
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1fb38170b1a978031a49490dc65a9dc4b606e67260ee874af2bfd0bf0132ec29
                                                                                                                                                                                                      • Instruction Fuzzy Hash: B9418C21A29A8250EA60FF3399D52F9E351BF857C0FE11132ED0D47696DEBCE501C660
                                                                                                                                                                                                      Function 00007FF784E4DF98 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                      • API String ID: 849930591-393685449
                                                                                                                                                                                                      • Opcode ID: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                                                                                                                                                      • Instruction ID: d4151b98b99412d0c0af051eb72f6f67dc9181724e383854df8a9316a3066948
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7d7d5a635fcd63c536a58b816f4712f1a96a9e43b0d550c3d6dd02e630e8922c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A3D16032A08B4186EB20AF7A94807ADB7A0FB55798FA00135EE8D57B95DF7CE481C711
                                                                                                                                                                                                      Function 00007FFBAA6516E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                      • String ID: a unicode character$argument$category
                                                                                                                                                                                                      • API String ID: 2803103377-2068800536
                                                                                                                                                                                                      • Opcode ID: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
                                                                                                                                                                                                      • Instruction ID: 88c6a9aafeabf3f957d0dc9d5a8c218e201b9417092a579ff158e998eb81fc47
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c9d1e3034f28ed3d090bffcd2b1c2b74113939870b399ed50bdb72791e912429
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 235106E1B0AA47C2EB2A8B2DDC5027923A9EB40F84F045075DE4F47394DF2DE842CB20
                                                                                                                                                                                                      Function 00007FFBAA651590 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 112COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Unicode_$Arg_ArgumentFromReadyStringSubtypeType_
                                                                                                                                                                                                      • String ID: a unicode character$argument$bidirectional
                                                                                                                                                                                                      • API String ID: 2803103377-2110215792
                                                                                                                                                                                                      • Opcode ID: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
                                                                                                                                                                                                      • Instruction ID: f69db6a3fb8fcb32b141d6d13f468e1f274586af6b7868bd4dd8bc22b87bbafd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79e1f8ae2df2e93481f857dbc231cf2a034c20faf15badcceea9109bcd0af3e1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3041C2A1B1A643C2EB5A4B3DC86437923A9EF44F44F586175DE4F47294DF3CE8468B20
                                                                                                                                                                                                      Function 00007FFBAA654498 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 87COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FromStringUnicode_$S_snprintfSizeSubtypeType_memcpy
                                                                                                                                                                                                      • String ID: $%04X
                                                                                                                                                                                                      • API String ID: 762632776-4013080060
                                                                                                                                                                                                      • Opcode ID: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
                                                                                                                                                                                                      • Instruction ID: d4a869f95675752705d6808b3df3d327e23cb39c56f83df8fe4caa2a1c6ac644
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 86c188bc8851d71fee5143397eab43a3575e426cb52b14b86a1d2f1ad77da2b4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8831A2E2A4998281EB228B28DC183B967A5FF44F94F4412B5CE6E476C4DF2CE446CB10
                                                                                                                                                                                                      Function 00007FFBAA6541C8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument$combining
                                                                                                                                                                                                      • API String ID: 3097524968-4202047184
                                                                                                                                                                                                      • Opcode ID: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
                                                                                                                                                                                                      • Instruction ID: 5d6ce02a6066dcf77cd82742cdf7546ba39bade2508b4852bf3c05c8f282c490
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8dcec4442920f3b8f18acdd6a11acb662b49feb7bbe0bfb657696819d5b5ca8f
                                                                                                                                                                                                      • Instruction Fuzzy Hash: BD01C8A4E4A643C1EA568B79EC482742299AF45F94F4471F4DD1E47294DF3CE4478B20
                                                                                                                                                                                                      Function 00007FFBAA654A44 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_ArgumentErr_FromLongLong_OccurredReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument$mirrored
                                                                                                                                                                                                      • API String ID: 3097524968-4001128513
                                                                                                                                                                                                      • Opcode ID: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
                                                                                                                                                                                                      • Instruction ID: 76b85470033f288024a094a9086f74480fda750f0e84e4ae84ff6e74e640e41c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c10d4c018a97ffc3e2d3961057942d7e2c7a14af83ba5a253b81f33c79b69d04
                                                                                                                                                                                                      • Instruction Fuzzy Hash: CE01A5B0E0A683C1EA969B38EC482782259EF04F54F4461F4DD1E46298DF3CE4878B24
                                                                                                                                                                                                      Function 00007FFBAA6511D0 Relevance: 10.8, APIs: 7, Instructions: 321COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Mem_$MallocSubtypeType_$DeallocErr_FreeMemory
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4139299733-0
                                                                                                                                                                                                      • Opcode ID: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
                                                                                                                                                                                                      • Instruction ID: 39ab54bb1029f3def65e760e735f09934c67ad5996f4cd760e20c46d5b52e211
                                                                                                                                                                                                      • Opcode Fuzzy Hash: b618ed634e65c7a0afdbbdfe658f43664214b0bdfe946ac4b4ba603eb4efd133
                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBD1ACF2E0A653C1EA269B29D85467963A9FB45F40F1421B1DE9F46680DF7CE843CB20
                                                                                                                                                                                                      Function 00007FF784E42310 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 99windowCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E42360
                                                                                                                                                                                                      • FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF784E42AC6,?,00007FF784E42BC5), ref: 00007FF784E4241A
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentFormatMessageProcess
                                                                                                                                                                                                      • String ID: %ls$%ls: $<FormatMessageW failed.>$[PYI-%d:ERROR]
                                                                                                                                                                                                      • API String ID: 27993502-4247535189
                                                                                                                                                                                                      • Opcode ID: 0a5126680d9a5a33d726664b64f5652ef3955638bb5392e7feaf9fce88ad1497
                                                                                                                                                                                                      • Instruction ID: eb83595fb3209f398ffcb262a610ad5081c5876152463499503d92b5fb7fad27
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0a5126680d9a5a33d726664b64f5652ef3955638bb5392e7feaf9fce88ad1497
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4531E262B08A4151EA20BF36B8846AAE361FF84BD5FD10135EF8D93A59DE7CE106C710
                                                                                                                                                                                                      Function 00007FF784E4D258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D2DD
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D2EB
                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D315
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D383
                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF784E4D50A,?,?,?,00007FF784E4D1FC,?,?,?,00007FF784E4CDF9), ref: 00007FF784E4D38F
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                                      • Opcode ID: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                                                                                                                                                      • Instruction ID: db04b3c516f8c704423ca27faaf446b5c2a7eff6ec977ee6c2a5b8a85646aab7
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ec1d8984956c5f4cef63aabdc1ab3d005d502d88db624b4fbd9ceb099b80f4f4
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8B31B421B1AE4291EE52AF23A480A79A3D4FF49BA4FE90535DD9D47780DFBCE445C320
                                                                                                                                                                                                      Function 00007FF784E47BB0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 995526605-0
                                                                                                                                                                                                      • Opcode ID: 8992b8672a535dc272058cf2d7ce2ed92b68d2797384361def583f81f46b136e
                                                                                                                                                                                                      • Instruction ID: 2439c2519a471b4c1c00dba6e3d7bd65f94108691d540a0660ae97621f6affe3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8992b8672a535dc272058cf2d7ce2ed92b68d2797384361def583f81f46b136e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D1210531A0CE4241EA50AF66B4C452AE7A1FB857A0FA40235D69D43AE4DEFCD445C750
                                                                                                                                                                                                      Function 00007FF784E5C050 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: 7e861b1c13b2d150705a6a4d04516104d82a3e3d825180b95c5380022c1757db
                                                                                                                                                                                                      • Instruction ID: 4ab88c7342ca011cc9646d3e74635411f7faf361902bb434aeb81fcd58ff9cf0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7e861b1c13b2d150705a6a4d04516104d82a3e3d825180b95c5380022c1757db
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F3214110A0C24242F9A5BF2396D1139D292BF447B0FF54734D93E976D6EDECA841C320
                                                                                                                                                                                                      Function 00007FFBAA6542BC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument 1$decimal
                                                                                                                                                                                                      • API String ID: 3545102714-2474051849
                                                                                                                                                                                                      • Opcode ID: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
                                                                                                                                                                                                      • Instruction ID: 128f8b32cd15cb009c2d1f94bdcb25242c6e0a81348951e5d5edd881bc344f85
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37a4153ce9cd5952ba336a7a13e7d13d1a4106d113bef46bdc421c90457116d1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: DD21D1B1A19A83C5EB518F2AEC442A92369FB44F84F4860B5DE4D43764CF3DE447CB20
                                                                                                                                                                                                      Function 00007FFBAA654C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument 1$numeric
                                                                                                                                                                                                      • API String ID: 3545102714-2385192657
                                                                                                                                                                                                      • Opcode ID: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
                                                                                                                                                                                                      • Instruction ID: add4e60769d2d9c7863c32e49f6d3c7cb08751e653fe1d9c024872ae3b3243a8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 35c9d41c65e7a6057b424292e649dab30af98cc9056b9a63245a5d832090e137
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4F219FB1A09A83C5EB518B2AEC482A92369EB44F84F5861B5DE1D43354DF3DE457CF20
                                                                                                                                                                                                      Function 00007FFBAA654B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_$ArgumentCheckPositionalReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument 1$name
                                                                                                                                                                                                      • API String ID: 3545102714-4190364640
                                                                                                                                                                                                      • Opcode ID: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
                                                                                                                                                                                                      • Instruction ID: 8ac032805320854862e4964a1a659b42918284a6715bbc8a8f72474eafdbcda3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: dd7e525c6f15f79c0475ece0fbfed555bc2cf029fe1f0485a725b85a65e47b36
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0A2180B1E09A83C5EA51DB29E8882A92369EB44F84F4450F5DE4D47754CF28E457CB10
                                                                                                                                                                                                      Function 00007FF784E68FDC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                                      • Opcode ID: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                                                                                                                                                      • Instruction ID: a801be8fad3792f7d685fcc31638cee1f42f7256b721e25a4ac5e90c1c8a847a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 09a7ef29c2f791f79e4b414a588c98caae924e0a86b8d7fe5631f15f3a619b4d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D116021B18A4186E790AF53F884729A6A0FB98BE4FA44234EA5D87794DFBCD414C750
                                                                                                                                                                                                      Function 00007FF784E479B0 Relevance: 9.1, APIs: 6, Instructions: 127COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(FFFFFFFF,?,?,00000000,00007FF784E48706), ref: 00007FF784E479E2
                                                                                                                                                                                                      • K32EnumProcessModules.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47A39
                                                                                                                                                                                                        • Part of subcall function 00007FF784E48950: MultiByteToWideChar.KERNEL32(?,?,?,00007FF784E43A04,00000000,00007FF784E41965), ref: 00007FF784E48989
                                                                                                                                                                                                      • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47AC8
                                                                                                                                                                                                      • K32GetModuleFileNameExW.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B34
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B45
                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,00000000,00007FF784E48706), ref: 00007FF784E47B5A
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3462794448-0
                                                                                                                                                                                                      • Opcode ID: 0d5c48301f66bbb06c3ab9ad7cc9d427668be6a953c5e07b4613718c31eabca3
                                                                                                                                                                                                      • Instruction ID: 8c7e4533666c868978b95f8109ba740849e318b5ec632d88f8712f48edcea338
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0d5c48301f66bbb06c3ab9ad7cc9d427668be6a953c5e07b4613718c31eabca3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E341A362B19E8241EA30AF23A5C06AAA395FF84BC4F950135DF8D577C9DE7CE501C760
                                                                                                                                                                                                      Function 00007FF784E485C0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetCurrentProcess.KERNEL32 ref: 00007FF784E47BD0
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: OpenProcessToken.ADVAPI32 ref: 00007FF784E47BE3
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetTokenInformation.ADVAPI32 ref: 00007FF784E47C08
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetLastError.KERNEL32 ref: 00007FF784E47C12
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: GetTokenInformation.ADVAPI32 ref: 00007FF784E47C52
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF784E47C6E
                                                                                                                                                                                                        • Part of subcall function 00007FF784E47BB0: CloseHandle.KERNEL32 ref: 00007FF784E47C86
                                                                                                                                                                                                      • LocalFree.KERNEL32(00000000,00007FF784E43099), ref: 00007FF784E4864C
                                                                                                                                                                                                      • LocalFree.KERNEL32 ref: 00007FF784E48655
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
                                                                                                                                                                                                      • String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
                                                                                                                                                                                                      • API String ID: 6828938-1529539262
                                                                                                                                                                                                      • Opcode ID: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                                                                                                                                                      • Instruction ID: ad025503cb6a7b923866dc14a6c3371c6c96c4c5cffe3c659115aa5f9b43da03
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d798866db3bd5df2efb7bc743f04e88858d4d647152387f2e8ebfd41b25b19db
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 24215121A08A8291F650BF22E5953EAF351FB94780FE44435EA4D43B96DFBCD544C760
                                                                                                                                                                                                      Function 00007FF784E5C1C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C1D7
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C20D
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C23A
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C24B
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C25C
                                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF784E55E51,?,?,?,?,00007FF784E5B392,?,?,?,?,00007FF784E580CB), ref: 00007FF784E5C277
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                      • Opcode ID: ac59ac31d7f732554de99c3fa9d4ab545aa66469dac59f93124fa2137bdd3152
                                                                                                                                                                                                      • Instruction ID: 9186a9f8f7af570b9f9e0698da34f567a271172a51cd587d5c1bbd9f6a5a7ecf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ac59ac31d7f732554de99c3fa9d4ab545aa66469dac59f93124fa2137bdd3152
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4115E24A0C65242FA94BFA3A6D1139D192BF447B0FF54734DC2E966D6EEECA841C320
                                                                                                                                                                                                      Function 00007FFBAA654D58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DoubleErr_Float_FromNumericStringSubtypeType_Unicode_
                                                                                                                                                                                                      • String ID: not a numeric character
                                                                                                                                                                                                      • API String ID: 1034370217-2058156748
                                                                                                                                                                                                      • Opcode ID: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
                                                                                                                                                                                                      • Instruction ID: 67e3216856033d35943a4ca396f752ff6c5127f1fd142bbf68886278c5ee5927
                                                                                                                                                                                                      • Opcode Fuzzy Hash: e94a4cbcbf0e5bcd60c879edbbe527308af40d50addda8a0dc073dd71fed3554
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2911A8A1D4F943C1EB634B39E81813967AAAF44F84F04A2F0CD0E16654DF2CE4478F20
                                                                                                                                                                                                      Function 00007FFBAA654384 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DecimalDigitErr_FromLongLong_StringSubtypeType_Unicode_
                                                                                                                                                                                                      • String ID: not a decimal
                                                                                                                                                                                                      • API String ID: 3750391552-3590249192
                                                                                                                                                                                                      • Opcode ID: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
                                                                                                                                                                                                      • Instruction ID: be15fec1e8a4cef481d79ef84ddd4c69819122fe2a2db87310a88d11affaaf80
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1cd0ce8ce41aec67d618eaf50ce9a381a57b186b45043069d79b570d0f92dffd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: C411A791B4AA43C1EB164B3AE81823D279AEF44F84F4464F5CD0F47660DF2DE4438B20
                                                                                                                                                                                                      Function 00007FFBAA6546E8 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument$east_asian_width
                                                                                                                                                                                                      • API String ID: 1875788646-3913127203
                                                                                                                                                                                                      • Opcode ID: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
                                                                                                                                                                                                      • Instruction ID: 5f6d018767ed305bdf7b9042e2e1539700f26ae8af741e5ef5c516c3021d3099
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1cd4da9dc117a34be79d860a1371cb1431d82210e1bfc1e6159635a71f123b29
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3001A2E0E0A683C5EA568B39ED482B52369AF06F94F4470F1DD0E06294DF3CD4878B20
                                                                                                                                                                                                      Function 00007FFBAA65441C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Arg_ArgumentReadyUnicode_
                                                                                                                                                                                                      • String ID: a unicode character$argument$decomposition
                                                                                                                                                                                                      • API String ID: 1875788646-2471543666
                                                                                                                                                                                                      • Opcode ID: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
                                                                                                                                                                                                      • Instruction ID: 45f83380551bc39bb4f5fcaab7cdb67925dfad4092fc88e038da20f281c721cf
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8e092fff27016ad70a75c21de804b5fd7f142a4693611c384d04bc395b3b3e7a
                                                                                                                                                                                                      • Instruction Fuzzy Hash: AA01A2E0A49683C1EA56DB39ED482B92369EF05F94F4460B5DD5E06294DF3CD4878B20
                                                                                                                                                                                                      Function 00007FFBAA652620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Mem_$Capsule_Err_FreeMallocMemory
                                                                                                                                                                                                      • String ID: unicodedata._ucnhash_CAPI
                                                                                                                                                                                                      • API String ID: 3673501854-3989975041
                                                                                                                                                                                                      • Opcode ID: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
                                                                                                                                                                                                      • Instruction ID: 14a9915f7f62b746bd952dcf9cf89394b8c888f77e5435fc6ce6a0b274abb906
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c8937bca7593cf83dc6e6686b6a5b89807f230b44c95862bfa962c91a770e15
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2EF019A0A0BB43D2EA129B79EC1427462ACBF18F84F4820B5DC4E06354EF3CE0468B60
                                                                                                                                                                                                      Function 00007FF784E5A9C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                      • Opcode ID: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                                                                                                                                                      • Instruction ID: 3d0da61b76cfdf17f27a85be50f92eb419fba3f2c0bb7522c9d58099b29f47e0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: f90418b582b416691a14bbb2ae6c6b71f2096e7654ee2338269033ad2dc175a6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FCF0F661B1CB0291FB20AF62E4C47399320FF49761FE40635CAAE862E4CFACD044C720
                                                                                                                                                                                                      Function 00007FF784E6A5D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                                      • Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                      • Instruction ID: 356212c949d01d1593e20e7bf22a0e37e585d25e51534fa52aee0e6b0069092b
                                                                                                                                                                                                      • Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 16116D72E58B0221FA743926D5D237FB0507F5A368FA45A34E96E072D6CEECA851C131
                                                                                                                                                                                                      Function 00007FF784E5C290 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2AF
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2CE
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C2F6
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C307
                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF784E5B4E7,?,?,00000000,00007FF784E5B782,?,?,?,?,?,00007FF784E5B70E), ref: 00007FF784E5C318
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: 7deb42c8f0324a16aa6e6d98ee2ae7cc2d1f88d9baa526aad775adab58b08f58
                                                                                                                                                                                                      • Instruction ID: 245238a339ee0f4bbd9a4d11596c447c1cfc468ad8c64cb8a969a8952493eb7f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7deb42c8f0324a16aa6e6d98ee2ae7cc2d1f88d9baa526aad775adab58b08f58
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73116011E0C64642F9A4BF67A5D1179A181BF447B0FE54334E92E966D6EDECA802C220
                                                                                                                                                                                                      Function 00007FF784E5C124 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                      • Opcode ID: d8a93f30c514b9ca08edce8a37f6d9cc5fb21c897957857cccbf80552a5a1f13
                                                                                                                                                                                                      • Instruction ID: 174f68d03fa3c1c83b7fb5f63a21e084d6e565dee82e3fb4e00d367b166aa7d1
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d8a93f30c514b9ca08edce8a37f6d9cc5fb21c897957857cccbf80552a5a1f13
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26110A10A0824742F9A9BE7389E117991916F54370FFA1734DA3E9A2D7EDECB801C670
                                                                                                                                                                                                      Function 00007FF784E485B0 Relevance: 7.5, APIs: 5, Instructions: 36sleepthreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Window$Process$ConsoleCurrentShowSleepThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 3908687701-0
                                                                                                                                                                                                      • Opcode ID: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                                                                                                                                                      • Instruction ID: f87901b7b9df9eb086b4455fc05136a7e23ab154be23396b5ae9f7659efc5c62
                                                                                                                                                                                                      • Opcode Fuzzy Hash: c4ce1bea477394a5bd7c29aaffed6a601c2f4b1d57d0592e327ceaa9095476a5
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A5016D24E1CB4282EA546F37B4C4439A3A0FF44B84FE45135DA8F46668DEBCE841C720
                                                                                                                                                                                                      Function 00007FF784E56F60 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: verbose
                                                                                                                                                                                                      • API String ID: 3215553584-579935070
                                                                                                                                                                                                      • Opcode ID: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                                                                                                                                                      • Instruction ID: efc8fe9f20488b09a4daa4d9a05623981f5beecbd0221e2831124390d685085e
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5742ae6ca51b03e9d6fd204cb41504e479b7e72b202bc53543779a715851f7d3
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2D91DF32A08A4681F721AE66D4D077DB791BB04B94FE64236DA5DC73C5DEBCE812C321
                                                                                                                                                                                                      Function 00007FF784E60E38 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                      • API String ID: 3215553584-1196891531
                                                                                                                                                                                                      • Opcode ID: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                                                                                                                                                      • Instruction ID: 005e66dccaa3fd2d11934799cbf9872bf5fadee3165abbd6f8d0baba4eec5ebd
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 59f559b3b4a43374a67f10f227721a3fbc4a07d852e694dccd2ae9d3b54f0314
                                                                                                                                                                                                      • Instruction Fuzzy Hash: E781B432D08262A5FBA6AF67C190279F6A0BB11744FF59038CA0D57285EFADE801D761
                                                                                                                                                                                                      Function 00007FF784E4CBD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2395640692-1018135373
                                                                                                                                                                                                      • Opcode ID: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                                                                                                                                                      • Instruction ID: 9f7c9da73fd5bde78c1fd4898a418c21e84d3c247de96a96774fe3b427e0ebcb
                                                                                                                                                                                                      • Opcode Fuzzy Hash: ab412f78eb90613ff4c98a1fac2d50a5770803065215d444c3ce453a3de23157
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1851B932B19A018ADB14EF26E084A7DB791FB44B98FA24131DE4D47788DFBDE841D710
                                                                                                                                                                                                      Function 00007FF784E4E818 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                                      • Opcode ID: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                                                                                                                                                      • Instruction ID: 13528c6db90180aefb9ebbb0f55bb2f51ca19ba395c73ac4618960a9daf00f87
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 881cb4ef47e13874d43f93ad661edca9df8e178c9ea1252ba64912ddd8f944cb
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D4516F32908A4286EB74AF7B9084368B790FB54B94FA84175DB8C477D5CFBCE891C711
                                                                                                                                                                                                      Function 00007FF784E4E468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                                      • Opcode ID: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                                                                                                                                                      • Instruction ID: 1841808d44fb6b8bc8728af3f19d155022425b71b17f74053bcdc23511727142
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2d0d38728c8b81eb1afee087d1255ca92539906646f1d2432080e5defd871a42
                                                                                                                                                                                                      • Instruction Fuzzy Hash: ED618332908BC585D760AF2AE4807AAF7A0FB94794F544635EB9C07B95DFBCE190CB10
                                                                                                                                                                                                      Function 00007FF784E47260 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • CreateDirectoryW.KERNEL32(00000000,?,00007FF784E428EC,FFFFFFFF,00000000,00007FF784E4336A), ref: 00007FF784E47372
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CreateDirectory
                                                                                                                                                                                                      • String ID: %.*s$%s%c$\
                                                                                                                                                                                                      • API String ID: 4241100979-1685191245
                                                                                                                                                                                                      • Opcode ID: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
                                                                                                                                                                                                      • Instruction ID: ec7e009bba68ff033b09c4af82a6298c6f8d4e0aa3f8672764dee35fc0233869
                                                                                                                                                                                                      • Opcode Fuzzy Hash: edef38ff62529b20aa9e4dd174cb85ee92fdf6a12d4b4b11e6a9369b37dc6bc2
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8731F861719EC555EA21AF32E4903BAA354FB84BE0FA00631EEAD43BC9DE6CD605C710
                                                                                                                                                                                                      Function 00007FF784E42220 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,00007FF784E4866F), ref: 00007FF784E4226E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: %ls$WARNING$[PYI-%d:%ls]
                                                                                                                                                                                                      • API String ID: 2050909247-3372507544
                                                                                                                                                                                                      • Opcode ID: cd56b085d0efe57ed851e26dcf7edcd69fea37fd872acd839253eedc34ddd336
                                                                                                                                                                                                      • Instruction ID: 8b58b8206e607ccb4b30a453586d108277dbf9da5158026de0c0fbf0688cc8ca
                                                                                                                                                                                                      • Opcode Fuzzy Hash: cd56b085d0efe57ed851e26dcf7edcd69fea37fd872acd839253eedc34ddd336
                                                                                                                                                                                                      • Instruction Fuzzy Hash: A321C52261CB8251E610AF62F4856EAF354FF847C4F900135EA8D53A5ADE7CE215C750
                                                                                                                                                                                                      Function 00007FFBAA651EF0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • PyErr_SetString.PYTHON311(?,?,?,?,?,00007FFBAA651EDC), ref: 00007FFBAA653B6F
                                                                                                                                                                                                        • Part of subcall function 00007FFBAA651FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA652008
                                                                                                                                                                                                        • Part of subcall function 00007FFBAA651FD0: strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFBAA652026
                                                                                                                                                                                                      • PyErr_Format.PYTHON311 ref: 00007FFBAA651F53
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Err_strncmp$FormatString
                                                                                                                                                                                                      • String ID: name too long$undefined character name '%s'
                                                                                                                                                                                                      • API String ID: 3882229318-4056717002
                                                                                                                                                                                                      • Opcode ID: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                      • Instruction ID: 31b502d0a763366fd3b93430b991bfbd80c7c93d12f89f90a0c126264f391de8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8b8c9c862c8556266a26c0415d30d38fd4fd6db163ae40366dde064f1277ed55
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 211112B5A1A947C1EB019B78DC482B463A8FB48F48F801475CE0E47664DF6EE14BCB20
                                                                                                                                                                                                      Function 00007FF784E5D4A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                                      • Opcode ID: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                                                                                                                                                      • Instruction ID: c98a800f992210f9b69e821fb3198d88b4eb90f5d5102b362209f7112b0fb730
                                                                                                                                                                                                      • Opcode Fuzzy Hash: fabcd4fad7fa856dcf2e9951dc7cbf89ababb6e1d40fd4369e0489b0ae7d9f25
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18D13532F08A4089E710DF76D4806ACB7B5FB44798FA58235CE9E97B99DE78E406C710
                                                                                                                                                                                                      Function 00007FFBAA651FD0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 173stringCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: strncmp
                                                                                                                                                                                                      • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                                                                      • API String ID: 1114863663-87138338
                                                                                                                                                                                                      • Opcode ID: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
                                                                                                                                                                                                      • Instruction ID: 8d82724e2e175a92efe14f51ee58ad6dce76646774a994971a9e24c8bfd991bc
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8de3eb989cf6c62dcbce841305c01691443b1373284778389dc9e239678f53b6
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 406109B2B1A643C6E6618A3DEC0067A669AFB80F90F446275EF5D436C5EE3CD4038F10
                                                                                                                                                                                                      Function 00007FF784E60BFC Relevance: 6.2, APIs: 4, Instructions: 161COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_isindst
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 4170891091-0
                                                                                                                                                                                                      • Opcode ID: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                                                                                                                                                      • Instruction ID: 890672db28e4864a3198b0733a5666144d9e1a36d48fee072c3ba6288e145e33
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 89e82a0bcb92f9a57c8ce538440e566bc748d838767a3902d6c6661200ebf515
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5751F772F042219BEB14EF25D9D56BCA765BB10358FA00235DE2E92AE5EF78A441C710
                                                                                                                                                                                                      Function 00007FF784E56738 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2780335769-0
                                                                                                                                                                                                      • Opcode ID: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                                                                                                                                                      • Instruction ID: f8f4f25b11723a4a98c41509062594c7ec1a4c95c387c3008f9309e63ce02e78
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 77215611d5833cc4261aa3ce6efef3cbe316a0555a56b2abfd6bea145bf69a9d
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1951A122E086018AF710EF72D4803BDA3A1FF48B98FA54534DE0D87699DFB8D491C360
                                                                                                                                                                                                      Function 00007FFBAB7C35FC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1584470717.00007FFBAB7B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FFBAB7B0000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584440650.00007FFBAB7B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584521250.00007FFBAB7C5000.00000002.00000001.01000000.0000001B.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbab7b0000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                      • Opcode ID: 26147b7d45c19e840e79d12cba4f2deea72bb314bfc7ab700e980dee3f33f321
                                                                                                                                                                                                      • Instruction ID: d6050adab86c68c26dc8a8f90eb4965dac4b18e6693fd096dad190e2f7651ed9
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 26147b7d45c19e840e79d12cba4f2deea72bb314bfc7ab700e980dee3f33f321
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80114C72B15F058AEB418B70E8552A833A4FB1A759F440E35EE2D867B4DFB8D1988380
                                                                                                                                                                                                      Function 00007FF784E4C5E0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                      • Opcode ID: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                                                                                                                                                      • Instruction ID: e134854c2d7808d327d19b44f4b735758ac9ad905074b2bc38b8f7a22f84d7c3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d5122b7aff0e10d146bffe79506b726acaac58846df22bdc99709fd59aa8d240
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 67113022B18F059AEB00EF61E8942B873A4FB19758F941E31DA6D467A4DFBCD154C350
                                                                                                                                                                                                      Function 00007FFBAA652C0C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                      • Opcode ID: 82f0f9c915ca38b27df9a13535bd7a8d6766dc117c9a79f3edaf6f20f04facae
                                                                                                                                                                                                      • Instruction ID: 871c03bd43c2605cffaba996825f62b2c8ba17780902bfa1af14cf0418eae921
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 82f0f9c915ca38b27df9a13535bd7a8d6766dc117c9a79f3edaf6f20f04facae
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 11114C62B15F02C9EB008F74EC543A933A8FB19B58F441935DE6D467A4DF38D1998790
                                                                                                                                                                                                      Function 00007FFBAA904BEC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1582063800.00007FFBAA771000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFBAA770000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582036077.00007FFBAA770000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582260237.00007FFBAA9C7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582260237.00007FFBAAA0A000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582260237.00007FFBAAAC6000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582260237.00007FFBAAAEB000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582496194.00007FFBAAB88000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582567005.00007FFBAAC27000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582599540.00007FFBAAC28000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582647979.00007FFBAAC2C000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582688975.00007FFBAAC42000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582722138.00007FFBAAC49000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582768919.00007FFBAAC4B000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582826751.00007FFBAAC4C000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582853269.00007FFBAAC4D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582893779.00007FFBAAC50000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582923541.00007FFBAAC51000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582958993.00007FFBAAC58000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582998215.00007FFBAAC59000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583038649.00007FFBAAC5A000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583093607.00007FFBAAC5C000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583146638.00007FFBAAC60000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583178974.00007FFBAAC61000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583212301.00007FFBAAC62000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583248928.00007FFBAAC63000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583276559.00007FFBAAC68000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583309069.00007FFBAAC69000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583338603.00007FFBAAC6E000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583374232.00007FFBAAC6F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583405503.00007FFBAAC70000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583441660.00007FFBAAC71000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583479094.00007FFBAAC72000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583518952.00007FFBAAC73000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583547863.00007FFBAAC74000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583579691.00007FFBAAC77000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583609307.00007FFBAAC7C000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583643686.00007FFBAAC7D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583673730.00007FFBAAC7E000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583707508.00007FFBAAC7F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583736663.00007FFBAAC81000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583779500.00007FFBAAC82000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583809354.00007FFBAAC85000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583840252.00007FFBAAC86000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583902243.00007FFBAAC88000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583930308.00007FFBAAC89000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583958554.00007FFBAAC8B000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1583999238.00007FFBAAC8C000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584044493.00007FFBAAC8F000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584125920.00007FFBAACD0000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584160803.00007FFBAACDA000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584210336.00007FFBAACFE000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584254240.00007FFBAAD02000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584307301.00007FFBAAD03000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584307301.00007FFBAAD26000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1584392886.00007FFBAAD27000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa770000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                      • Opcode ID: 1ef51ae01d83f1794246b85f4b0a7714f604e55fa8319745b4855e583127c4fd
                                                                                                                                                                                                      • Instruction ID: 10b7bb14368827326703a796600b7890d5e1c66fa53499cd650b6022940dcded
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1ef51ae01d83f1794246b85f4b0a7714f604e55fa8319745b4855e583127c4fd
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 09114866B15F01CAEB00CF70E8542B833A8FB18B58F440E31DE6D827A4DF38D1998350
                                                                                                                                                                                                      Function 00007FF784E66D8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                                      • Opcode ID: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
                                                                                                                                                                                                      • Instruction ID: f7a0517e38f074684324dcc8deeaf156180c81a25e6df577673eb96878412b45
                                                                                                                                                                                                      • Opcode Fuzzy Hash: d0b5b4893435fc06bb44c0bfd3c4afae0be10aa3ee1d4f6c058f23408d263c6b
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1B411712A2828266FB60AF37D48137EE660FB90BA4FA44235EE5E06AD5DE7CD541C710
                                                                                                                                                                                                      Function 00007FF784E59F50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF784E59F82
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: RtlFreeHeap.NTDLL(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B47A
                                                                                                                                                                                                        • Part of subcall function 00007FF784E5B464: GetLastError.KERNEL32(?,?,?,00007FF784E63F92,?,?,?,00007FF784E63FCF,?,?,00000000,00007FF784E64495,?,?,?,00007FF784E643C7), ref: 00007FF784E5B484
                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF784E4C165), ref: 00007FF784E59FA0
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\main.exe
                                                                                                                                                                                                      • API String ID: 3580290477-2622834535
                                                                                                                                                                                                      • Opcode ID: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
                                                                                                                                                                                                      • Instruction ID: 19c9a2128df4c61b92639832a30f6db33f3ea4327c80a36e1e24d6bb509b39b0
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6a4dbdaa8dd2b454c87b42bcae1ae77807c0d922a2c4c320371c355071f6a322
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D8417332A08B5285EB25FF23A4C00BDA7A4FB44794FA64035EA4E87B55EFBDD441C320
                                                                                                                                                                                                      Function 00007FF784E5DB38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                                      • Opcode ID: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                                                                                                                                                      • Instruction ID: 78b7b772a37525ab0e67d1f470ce56fa23c33375b440e9857f4f990a93f55837
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 57f6403a17afa6857eb93518903eebf05678db2d18f563f749b6ba14b42682ba
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9141F622718A8181EB60EF26E4847B9B761FB84794FE14031EE8D87758EFBCD501C710
                                                                                                                                                                                                      Function 00007FF784E42020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF784E41B4A), ref: 00007FF784E42070
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: %s: %s$[PYI-%d:ERROR]
                                                                                                                                                                                                      • API String ID: 2050909247-3704582800
                                                                                                                                                                                                      • Opcode ID: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                                                                                                                                                      • Instruction ID: deb38be427c003165ec71feeaa837b9267b9d370f8f719f951837e48fce36f38
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a5f084cc36529dd82358bb6d3c03fbfc020d3d736b3f3fde6876dd26524326fa
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC21EA62B18A8155EA20AF72BC816E6E394BFC47D4F910131FE8D57749DE7CD155C210
                                                                                                                                                                                                      Function 00007FF784E60828 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                      • API String ID: 1611563598-336475711
                                                                                                                                                                                                      • Opcode ID: 329b1ba0e256b22385198653e79ab285c8b0391819b27a8993372820f1b36e2c
                                                                                                                                                                                                      • Instruction ID: ecc05c86831bf7ab86dce5660682b71947316955e12803338258768191e0b9e3
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 329b1ba0e256b22385198653e79ab285c8b0391819b27a8993372820f1b36e2c
                                                                                                                                                                                                      • Instruction Fuzzy Hash: FC21A222A0869191FB20EF26D48427DA3B1FB98B84FE54135D68D43685EFBCE945C7A0
                                                                                                                                                                                                      Function 00007FF784E42140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF784E428DA,FFFFFFFF,00000000,00007FF784E4336A), ref: 00007FF784E4218E
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: CurrentProcess
                                                                                                                                                                                                      • String ID: WARNING$[PYI-%d:%s]
                                                                                                                                                                                                      • API String ID: 2050909247-3752221249
                                                                                                                                                                                                      • Opcode ID: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                                                                                                                                                      • Instruction ID: 25fb3be4ac42f1119da6eb321ab325bf0fba1b1f5ba65daa82ee57d3db8799b8
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 28628bd70d5a97629098dcd42eabd330bee057474c06a66384895197b474a4b9
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7F118E22618B8551EA20AF62B8816EAF354FB847C4F900135FA8D43B5ADEBCD255C710
                                                                                                                                                                                                      Function 00007FF784E4F2D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                                      • Opcode ID: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                                                                                                                                                      • Instruction ID: 9e52011cde8873767f38295016449a268ea840346dd973f721c4b3b4a0ccd80f
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 778d4a5eeee770603d02c5501bef52114850414878b0bee781498c4a1570bacf
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 22112E32618B8182EB619F26F580269B7E4FB88B94FA84234DECD07758DF7CD551C710
                                                                                                                                                                                                      Function 00007FF784E619AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1579982150.00007FF784E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF784E40000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1579952042.00007FF784E40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580026868.00007FF784E6D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E80000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580060658.00007FF784E83000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E86000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784E95000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1580123175.00007FF784ECB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ff784e40000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                      • API String ID: 2595371189-336475711
                                                                                                                                                                                                      • Opcode ID: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                                                                                                                                                      • Instruction ID: 3278c317dba19ab198601585474856319d773e938eea94a9243fe5f9f7672f1c
                                                                                                                                                                                                      • Opcode Fuzzy Hash: a21020f9989eba13c36801fee87724dcdfb53302495b3b0e02d80308072ceaa1
                                                                                                                                                                                                      • Instruction Fuzzy Hash: D201842291C64285F721BFA2D4A127EE3A0FF44708FE05535D54D82699DFBCE504CB24
                                                                                                                                                                                                      Function 00007FFBAA654C08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: String$Err_FromUnicode_
                                                                                                                                                                                                      • String ID: no such name
                                                                                                                                                                                                      • API String ID: 3678473424-4211486178
                                                                                                                                                                                                      • Opcode ID: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
                                                                                                                                                                                                      • Instruction ID: 06ce99d0dcc327747c5fe924257b8bdc058dd8c753cc4b483632e0f21fdfb683
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 0bad81046192c5090e63041fc1c0adfcc3ec090d4373e4d8dfd61f48ff6f657e
                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9C0162B1A1AA47C1FA629B39EC543B52768BF98F44F4020B5DE4E46754DF3CE1068A20
                                                                                                                                                                                                      Function 00007FFBAA6525B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                      APIs
                                                                                                                                                                                                      • _PyObject_GC_New.PYTHON311(?,?,00000000,00007FFBAA652533), ref: 00007FFBAA6525B6
                                                                                                                                                                                                      • PyObject_GC_Track.PYTHON311(?,?,00000000,00007FFBAA652533), ref: 00007FFBAA6525E8
                                                                                                                                                                                                      Strings
                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                      • Source File: 00000003.00000002.1581675935.00007FFBAA651000.00000020.00000001.01000000.00000015.sdmp, Offset: 00007FFBAA650000, based on PE: true
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581642975.00007FFBAA650000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA655000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6B2000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA6FE000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA701000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA706000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581706355.00007FFBAA760000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1581969993.00007FFBAA763000.00000004.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      • Associated: 00000003.00000002.1582002251.00007FFBAA765000.00000002.00000001.01000000.00000015.sdmpDownload File
                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                      • Snapshot File: hcaresult_3_2_7ffbaa650000_main.jbxd
                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                      • API ID: Object_$Track
                                                                                                                                                                                                      • String ID: 3.2.0
                                                                                                                                                                                                      • API String ID: 16854473-1786766648
                                                                                                                                                                                                      • Opcode ID: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                      • Instruction ID: 120d856826a10a970a3ab900c209a1c12985d6de519ca38ec5fb0a19d34b5d3a
                                                                                                                                                                                                      • Opcode Fuzzy Hash: 767dd7ab98994f43239e4e329e749c2ad7475791c86a6fb4d160e6b955e6c056
                                                                                                                                                                                                      • Instruction Fuzzy Hash: F6E0EDA4E07B07D5EF168B39EC5406822ACBF08F04B442179CD4D02360EF3DE166CA60