Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
winws1.exe

Overview

General Information

Sample name:winws1.exe
Analysis ID:1576658
MD5:37e06d6e36e5f993a465b266ade15ea2
SHA1:e05d11786a37ec01145209156efc92e4ebf1ea38
SHA256:74ee005a858f35d69b9f32921ccf1039babc70e3a70872b5fd38edeadc0069c4
Tags:exeuser-sa6ta6ni6c
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected AntiVM5
AI detected suspicious sample
Contains functionality to infect the boot sector
Potentially malicious time measurement code found
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • winws1.exe (PID: 5776 cmdline: "C:\Users\user\Desktop\winws1.exe" MD5: 37E06D6E36E5F993A465B266ADE15EA2)
    • winws1.exe (PID: 5392 cmdline: "C:\Users\user\Desktop\winws1.exe" MD5: 37E06D6E36E5F993A465B266ADE15EA2)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_AntiVM_5Yara detected AntiVM_5Joe Security
    Process Memory Space: winws1.exe PID: 5392JoeSecurity_AntiVM_5Yara detected AntiVM_5Joe Security

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus / Scanner detection for submitted sample
      Source: winws1.exeAvira: detected
      Multi AV Scanner detection for submitted file
      Source: winws1.exeReversingLabs: Detection: 50%
      AI detected suspicious sample
      Source: Submited SampleIntegrated Neural Analysis Model: Matched 91.6% probability
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E4530 PyCMethod_New,CryptAcquireContextA,CryptAcquireContextA,CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,clock,clock,clock,clock,CryptReleaseContext,3_2_655E4530
      Source: winws1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb source: winws1.exe, 00000003.00000002.2277598800.00007FFDA3453000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: winws1.exe, 00000003.00000002.2274272378.00007FFD9DFD0000.00000002.00000001.01000000.0000000B.sdmp
      Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\select.pdb source: winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280744509.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp, select.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2279229897.00007FFDA3BF2000.00000002.00000001.01000000.0000001B.sdmp, _uuid.pyd.0.dr
      Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: winws1.exe, 00000003.00000002.2272888024.00007FFD94116000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2279018485.00007FFDA3AED000.00000002.00000001.01000000.00000009.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: winws1.exe, 00000003.00000002.2277927035.00007FFDA34CC000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: winws1.exe, 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280410219.00007FFDA4633000.00000002.00000001.01000000.00000017.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: winws1.exe, 00000000.00000003.2204338546.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2282140094.00007FFDAC141000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb!! source: winws1.exe, 00000003.00000002.2277598800.00007FFDA3453000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: winws1.exe, 00000003.00000002.2277230122.00007FFDA341D000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: winws1.exe, 00000000.00000003.2204338546.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2282140094.00007FFDAC141000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2277031140.00007FFDA2E97000.00000002.00000001.01000000.00000016.sdmp, _hashlib.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2275448309.00007FFD9F3DC000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: winws1.exe, 00000000.00000003.2205224817.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2281709657.00007FFDA5495000.00000002.00000001.01000000.0000000C.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
      Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2275448309.00007FFD9F3DC000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: winws1.exe, 00000003.00000002.2281120901.00007FFDA5470000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32ui.pdb source: win32ui.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\_win32sysloader.pdb source: winws1.exe, 00000000.00000003.2223739369.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: winws1.exe, 00000000.00000003.2224106785.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
      Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: winws1.exe, 00000003.00000002.2272888024.00007FFD94116000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
      Source: Binary string: .Pdb'L source: winws1.exe
      Source: Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280102430.00007FFDA4168000.00000002.00000001.01000000.00000010.sdmp, _socket.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264576711.000001EE73AF0000.00000002.00000001.01000000.00000006.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: winws1.exe, 00000003.00000002.2274272378.00007FFD9DFD0000.00000002.00000001.01000000.0000000B.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2270931396.00007FFD94090000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: winws1.exe, 00000003.00000002.2277927035.00007FFDA34CC000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\python311.pdb source: winws1.exe, 00000003.00000002.2268959946.00007FFD93783000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
      Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-1_1"not available source: winws1.exe, 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: winws1.exe, 00000000.00000003.2205224817.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2281709657.00007FFDA5495000.00000002.00000001.01000000.0000000C.sdmp
      Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: winws1.exe, 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmp
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF6113093B0 FindFirstFileExW,FindClose,0_2_00007FF6113093B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611329618 FindFirstFileExW,0_2_00007FF611329618
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF6113093B0 FindFirstFileExW,FindClose,3_2_00007FF6113093B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611329618 FindFirstFileExW,3_2_00007FF611329618
      Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
      Source: Joe Sandbox ViewIP Address: 104.26.12.205 104.26.12.205
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownDNS query: name: api.ipify.org
      Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D3480 strchr,WSAStartup,gethostbyname,socket,htons,ioctlsocket,ioctlsocket,connect,ioctlsocket,send,send,WSAGetLastError,closesocket,WSACleanup,SetLastError,recv,recv,closesocket,WSACleanup,strstr,toupper,strstr,toupper,toupper,toupper,toupper,strstr,memcmp,memcmp,_mktime64,gethostbyname,WSAGetLastError,WSAGetLastError,ioctlsocket,WSAGetLastError,WSAGetLastError,WSACleanup,SetLastError,WSAGetLastError,select,ioctlsocket,3_2_655D3480
      Source: global trafficDNS traffic detected: DNS query: api.ipify.org
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244289625.000001EE75FD8000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266330558.000001EE76568000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244480093.000001EE75EC2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://9x9o.com/ss122007.txt
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.dr, _socket.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
      Source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedZ
      Source: winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlv;u
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crld
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
      Source: winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crle
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
      Source: _hashlib.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2241708243.000001EE75FAE000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266330558.000001EE764C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244602379.000001EE75FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
      Source: winws1.exe, 00000003.00000003.2233299071.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234597826.000001EE75A44000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234530611.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl.
      Source: winws1.exe, 00000003.00000003.2240225562.000001EE75AC5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242671953.000001EE75AB5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244418170.000001EE75AC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
      Source: winws1.exe, 00000003.00000003.2240403329.000001EE75A70000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244523998.000001EE75E49000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240991420.000001EE75E43000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
      Source: winws1.exe, 00000003.00000003.2234597826.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234597826.000001EE75A44000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234530611.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75A33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html.
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.accv.es0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0A
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0C
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://ocsp.digicert.com0X
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75FB9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
      Source: winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://timgolden.me.uk/python/wmi.html
      Source: winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
      Source: winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es/legislacion_c.htm0U
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.accv.es00
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/0
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cert.fnmt.es/dpcs/1t#
      Source: winws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE759CA000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230534520.000001EE759C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
      Source: winws1.exe, 00000000.00000003.2208853652.000001F33E4C9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2213362525.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2209791088.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, python311.dll.0.dr, select.pyd.0.dr, _uuid.pyd.0.dr, _decimal.pyd.0.dr, libffi-8.dll.0.drString found in binary or memory: http://www.digicert.com/CPS0
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
      Source: winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E25000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239379563.000001EE75E84000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240991420.000001EE75E43000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
      Source: winws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231133560.000001EE75925000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
      Source: winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE76151000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
      Source: winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.phptrols
      Source: winws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE759CA000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230534520.000001EE759C6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cpsaV
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2241708243.000001EE75FAE000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244602379.000001EE75FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org
      Source: winws1.exe, 00000003.00000002.2267484754.000001EE76F68000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.org/
      Source: winws1.exe, 00000003.00000003.2238188206.000001EE75E66000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238736422.000001EE7597C000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42195.
      Source: winws1.exe, 00000003.00000003.2240403329.000001EE75A2F000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240301436.000001EE75A23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
      Source: winws1.exe, 00000003.00000002.2266031231.000001EE761C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
      Source: winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
      Source: winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
      Source: winws1.exe, winws1.exe, 00000003.00000002.2277723700.00007FFDA3461000.00000002.00000001.01000000.0000000E.sdmp, winws1.exe, 00000003.00000002.2278571156.00007FFDA3514000.00000002.00000001.01000000.0000000D.sdmp, winws1.exe, 00000003.00000002.2274605182.00007FFD9DFE1000.00000002.00000001.01000000.0000000B.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.drString found in binary or memory: https://github.com/mhammond/pywin32
      Source: winws1.exe, 00000003.00000002.2266330558.000001EE76568000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/psf/requests/pull/6710
      Source: winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264660625.000001EE75348000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
      Source: winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
      Source: winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
      Source: winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
      Source: winws1.exe, 00000003.00000003.2236513135.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/216
      Source: winws1.exe, 00000003.00000002.2266031231.000001EE761C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
      Source: winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
      Source: winws1.exe, 00000003.00000003.2236513135.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3020
      Source: winws1.exe, 00000003.00000003.2240403329.000001EE75A2F000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240301436.000001EE75A23000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/api/195988555454
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google.com/api/195988555454cached__
      Source: winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE75910000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
      Source: winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
      Source: winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
      Source: winws1.exe, 00000003.00000002.2266330558.000001EE764C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
      Source: winws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
      Source: winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
      Source: winws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://json.org
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2243831229.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
      Source: winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://packaging.python.org/specifications/entry-points/
      Source: winws1.exe, 00000003.00000002.2264660625.000001EE752C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
      Source: winws1.exe, 00000003.00000002.2268959946.00007FFD93783000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://peps.python.org/pep-0263/
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BIOS_Serial_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txtpyd0
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Serial_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/CPU_Serial_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/DiskDrive_Serial_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/HwProfileGuid_List.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/MachineGuid.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/gpu_list.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txt0
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/ip_list.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/mac_list.txt
      Source: winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/gabjohn3/nb/main/pc_platforms.txt
      Source: winws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
      Source: winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io0
      Source: winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745.
      Source: winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E25000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
      Source: winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
      Source: winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
      Source: winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2272951519.00007FFD9414B000.00000002.00000001.01000000.00000015.sdmp, winws1.exe, 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: https://www.openssl.org/H
      Source: winws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
      Source: winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2243831229.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
      Source: winws1.exe, 00000003.00000003.2229717057.000001EE75749000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264660625.000001EE752C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228526070.000001EE75757000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
      Source: winws1.exe, 00000003.00000002.2269198177.00007FFD93818000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drString found in binary or memory: https://www.python.org/psf/license/
      Source: winws1.exe, 00000003.00000003.2242671953.000001EE75AB5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/
      Source: winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wwww.certigna.fr/autorites/0m
      Source: winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE75910000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D31A0 WSAStartup,gethostbyname,socket,setsockopt,setsockopt,setsockopt,htons,sendto,sendto,recvfrom,recvfrom,ntohl,ntohl,ntohl,closesocket,WSACleanup,WSAGetLastError,closesocket,WSACleanup,SetLastError,WSAGetLastError,WSACleanup,SetLastError,3_2_655D31A0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D2390: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy,3_2_655D2390
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF61130AAA00_2_00007FF61130AAA0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611307F600_2_00007FF611307F60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF61130B2780_2_00007FF61130B278
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611309A600_2_00007FF611309A60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF6113027100_2_00007FF611302710
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611315D5A0_2_00007FF611315D5A
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF61130B4780_2_00007FF61130B478
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF61130B4580_2_00007FF61130B458
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF61130D1000_2_00007FF61130D100
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C75903_2_655C7590
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C65803_2_655C6580
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D3CE03_2_655D3CE0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D55403_2_655D5540
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D75003_2_655D7500
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656165E03_2_656165E0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D47103_2_655D4710
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E07303_2_655E0730
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656277E03_2_656277E0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E67D03_2_655E67D0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655EC7B03_2_655EC7B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E96F03_2_655E96F0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656176853_2_65617685
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E46B03_2_655E46B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655EE1403_2_655EE140
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655EB1703_2_655EB170
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656180A03_2_656180A0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D73603_2_655D7360
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655DB3003_2_655DB300
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656273003_2_65627300
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655EE3C03_2_655EE3C0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655CF2403_2_655CF240
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E82703_2_655E8270
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E92D03_2_655E92D0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C7D503_2_655C7D50
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65601DE03_2_65601DE0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65616DA03_2_65616DA0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E7D803_2_655E7D80
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C9CD03_2_655C9CD0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65627F003_2_65627F00
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655DFE703_2_655DFE70
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D3E603_2_655D3E60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C1E103_2_655C1E10
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_6563EE303_2_6563EE30
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E79903_2_655E7990
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D69A03_2_655D69A0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655CB8403_2_655CB840
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656198303_2_65619830
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C38D63_2_655C38D6
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655E38803_2_655E3880
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65640B603_2_65640B60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65618BC03_2_65618BC0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65608BB03_2_65608BB0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65620B803_2_65620B80
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65601A523_2_65601A52
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D7A203_2_655D7A20
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C3AC13_2_655C3AC1
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF61130B2783_2_00007FF61130B278
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF61130AAA03_2_00007FF61130AAA0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611309A603_2_00007FF611309A60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF61130B4783_2_00007FF61130B478
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF61130B4583_2_00007FF61130B458
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF6113027103_2_00007FF611302710
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611315D5A3_2_00007FF611315D5A
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF61130D1003_2_00007FF61130D100
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611307F603_2_00007FF611307F60
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B5F0B3_2_00007FFD930B5F0B
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B55103_2_00007FFD930B5510
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B44C63_2_00007FFD930B44C6
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930CD2603_2_00007FFD930CD260
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B53A83_2_00007FFD930B53A8
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B42873_2_00007FFD930B4287
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B5BF03_2_00007FFD930B5BF0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD932692103_2_00007FFD93269210
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930D52003_2_00007FFD930D5200
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B68C53_2_00007FFD930B68C5
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B71083_2_00007FFD930B7108
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B216C3_2_00007FFD930B216C
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B4F3E3_2_00007FFD930B4F3E
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B21353_2_00007FFD930B2135
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B53C13_2_00007FFD930B53C1
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B63893_2_00007FFD930B6389
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B15C83_2_00007FFD930B15C8
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B54CF3_2_00007FFD930B54CF
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD931F15C03_2_00007FFD931F15C0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B54CA3_2_00007FFD930B54CA
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B3A8F3_2_00007FFD930B3A8F
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B542F3_2_00007FFD930B542F
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B655F3_2_00007FFD930B655F
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B12993_2_00007FFD930B1299
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B4AC53_2_00007FFD930B4AC5
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B50473_2_00007FFD930B5047
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B560F3_2_00007FFD930B560F
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B72523_2_00007FFD930B7252
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B38323_2_00007FFD930B3832
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B35FD3_2_00007FFD930B35FD
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B1CFD3_2_00007FFD930B1CFD
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B59F73_2_00007FFD930B59F7
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B3A853_2_00007FFD930B3A85
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD932699E03_2_00007FFD932699E0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B50AB3_2_00007FFD930B50AB
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD932519203_2_00007FFD93251920
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B47463_2_00007FFD930B4746
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B57D13_2_00007FFD930B57D1
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B43593_2_00007FFD930B4359
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B378D3_2_00007FFD930B378D
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B73653_2_00007FFD930B7365
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B1D833_2_00007FFD930B1D83
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD931E5E303_2_00007FFD931E5E30
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B266C3_2_00007FFD930B266C
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B72A73_2_00007FFD930B72A7
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B3BA23_2_00007FFD930B3BA2
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B29823_2_00007FFD930B2982
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B2D0B3_2_00007FFD930B2D0B
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B16223_2_00007FFD930B1622
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD931604403_2_00007FFD93160440
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B2C753_2_00007FFD930B2C75
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD932682E03_2_00007FFD932682E0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B14243_2_00007FFD930B1424
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B2E8C3_2_00007FFD930B2E8C
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 65662CA8 appears 44 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FFD930B2A04 appears 91 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FFD930B1EF1 appears 462 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FF611302F40 appears 178 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 65662C60 appears 59 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FF611302FE0 appears 32 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FFD930B4057 appears 251 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FFD930B483B appears 42 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FFD930B2734 appears 152 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 00007FF611302E60 appears 98 times
      Source: C:\Users\user\Desktop\winws1.exeCode function: String function: 655DD200 appears 235 times
      Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
      Source: pyarmor_runtime.pyd.0.drStatic PE information: Number of sections : 11 > 10
      Source: winws1.exeStatic PE information: Number of sections : 12 > 10
      Source: python3.dll.0.drStatic PE information: No import functions for PE file found
      Source: winws1.exe, 00000000.00000003.2204338546.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2224106785.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2223785951.000001F33E4CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2216061386.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2205224817.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2205752372.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206766928.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2223739369.000001F33E4CC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2203404766.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2223885708.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2205538641.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2209988756.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2223739369.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs winws1.exe
      Source: winws1.exe, 00000000.00000003.2219807134.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs winws1.exe
      Source: winws1.exeBinary or memory string: OriginalFilename vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2264576711.000001EE73AF0000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2277723700.00007FFDA3461000.00000002.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2272951519.00007FFD9414B000.00000002.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamelibsslH vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2278571156.00007FFDA3514000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamepythoncom311.dll0 vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2276415063.00007FFD9F3E5000.00000002.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2281856248.00007FFDA5499000.00000002.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2277399779.00007FFDA3435000.00000002.00000001.01000000.00000013.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2280898704.00007FFDA4DA6000.00000002.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2280527674.00007FFDA4636000.00000002.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2279355980.00007FFDA3BF4000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2277120403.00007FFDA2E9E000.00000002.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2274605182.00007FFD9DFE1000.00000002.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilenamepywintypes311.dll0 vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2270761344.00007FFD939B7000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenamepython311.dll. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2272668848.00007FFD94095000.00000002.00000001.01000000.0000001A.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2282178975.00007FFDAC147000.00000002.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2279094842.00007FFDA3AF2000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2281293693.00007FFDA547D000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs winws1.exe
      Source: winws1.exe, 00000003.00000002.2280201912.00007FFDA4172000.00000002.00000001.01000000.00000010.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs winws1.exe
      Source: classification engineClassification label: mal76.evad.winEXE@3/34@1/1
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611308CD0 FormatMessageW,WideCharToMultiByte,GetLastError,0_2_00007FF611308CD0
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762Jump to behavior
      Source: winws1.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Users\user\Desktop\winws1.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: winws1.exeReversingLabs: Detection: 50%
      Source: C:\Users\user\Desktop\winws1.exeFile read: C:\Users\user\Desktop\winws1.exeJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\winws1.exe "C:\Users\user\Desktop\winws1.exe"
      Source: C:\Users\user\Desktop\winws1.exeProcess created: C:\Users\user\Desktop\winws1.exe "C:\Users\user\Desktop\winws1.exe"
      Source: C:\Users\user\Desktop\winws1.exeProcess created: C:\Users\user\Desktop\winws1.exe "C:\Users\user\Desktop\winws1.exe"Jump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: version.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: vcruntime140.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: libffi-8.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: vcruntime140_1.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: kernel.appcore.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: uxtheme.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: urlmon.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: iertutil.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: srvcli.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: netutils.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: secur32.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: sspicli.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: iphlpapi.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: powrprof.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: pdh.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: umpdc.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: wtsapi32.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: libcrypto-1_1.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: libssl-1_1.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: mswsock.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: wbemcomn.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: amsi.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: userenv.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: profapi.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: sxs.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: dnsapi.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: rasadhlp.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeSection loaded: fwpuclnt.dllJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
      Source: winws1.exeStatic PE information: Image base 0x140000000 > 0x60000000
      Source: winws1.exeStatic file information: File size 11878277 > 1048576
      Source: winws1.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb source: winws1.exe, 00000003.00000002.2277598800.00007FFDA3453000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb** source: winws1.exe, 00000003.00000002.2274272378.00007FFD9DFD0000.00000002.00000001.01000000.0000000B.sdmp
      Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\select.pdb source: winws1.exe, 00000000.00000003.2221428860.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280744509.00007FFDA4DA3000.00000002.00000001.01000000.00000011.sdmp, select.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_uuid.pdb source: winws1.exe, 00000000.00000003.2206923198.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2279229897.00007FFDA3BF2000.00000002.00000001.01000000.0000001B.sdmp, _uuid.pyd.0.dr
      Source: Binary string: D:\_w\1\b\libssl-1_1.pdb source: winws1.exe, 00000003.00000002.2272888024.00007FFD94116000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_bz2.pdb source: winws1.exe, 00000000.00000003.2205389681.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2279018485.00007FFDA3AED000.00000002.00000001.01000000.00000009.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb source: winws1.exe, 00000003.00000002.2277927035.00007FFDA34CC000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: winws1.exe, 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_queue.pdb source: winws1.exe, 00000000.00000003.2206364856.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280410219.00007FFDA4633000.00000002.00000001.01000000.00000017.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: winws1.exe, 00000000.00000003.2204338546.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2282140094.00007FFDAC141000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32api.pdb!! source: winws1.exe, 00000003.00000002.2277598800.00007FFDA3453000.00000002.00000001.01000000.0000000E.sdmp, win32api.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_ssl.pdb source: winws1.exe, 00000003.00000002.2277230122.00007FFDA341D000.00000002.00000001.01000000.00000013.sdmp, _ssl.pyd.0.dr
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: winws1.exe, 00000000.00000003.2204338546.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2282140094.00007FFDAC141000.00000002.00000001.01000000.00000005.sdmp, VCRUNTIME140.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_hashlib.pdb source: winws1.exe, 00000000.00000003.2206011466.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2277031140.00007FFDA2E97000.00000002.00000001.01000000.00000016.sdmp, _hashlib.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdb source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2275448309.00007FFD9F3DC000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: winws1.exe, 00000000.00000003.2205224817.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2281709657.00007FFDA5495000.00000002.00000001.01000000.0000000C.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb$$ source: _decimal.pyd.0.dr
      Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\_lzma.pdbNN source: winws1.exe, 00000000.00000003.2206185222.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2275448309.00007FFD9F3DC000.00000002.00000001.01000000.0000000A.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_ctypes.pdb source: winws1.exe, 00000003.00000002.2281120901.00007FFDA5470000.00000002.00000001.01000000.00000007.sdmp, _ctypes.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32ui.pdb source: win32ui.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\_win32sysloader.pdb source: winws1.exe, 00000000.00000003.2223739369.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32trace.pdb source: winws1.exe, 00000000.00000003.2224106785.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, win32trace.pyd.0.dr
      Source: Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: winws1.exe, 00000003.00000002.2272888024.00007FFD94116000.00000002.00000001.01000000.00000015.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\win32ui.pdbOO source: win32ui.pyd.0.dr
      Source: Binary string: .Pdb'L source: winws1.exe
      Source: Binary string: D:\_w\1\b\bin\amd64\_socket.pdb source: winws1.exe, 00000000.00000003.2206520208.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2280102430.00007FFDA4168000.00000002.00000001.01000000.00000010.sdmp, _socket.pyd.0.dr
      Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: winws1.exe, 00000000.00000003.2210888476.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264576711.000001EE73AF0000.00000002.00000001.01000000.00000006.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\_decimal.pdb source: _decimal.pyd.0.dr
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pywintypes.pdb source: winws1.exe, 00000003.00000002.2274272378.00007FFD9DFD0000.00000002.00000001.01000000.0000000B.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\unicodedata.pdb source: winws1.exe, 00000000.00000003.2223260935.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2270931396.00007FFD94090000.00000002.00000001.01000000.0000001A.sdmp
      Source: Binary string: D:\a\pywin32\pywin32\build\temp.win-amd64-cpython-311\Release\pythoncom.pdb}},GCTL source: winws1.exe, 00000003.00000002.2277927035.00007FFDA34CC000.00000002.00000001.01000000.0000000D.sdmp
      Source: Binary string: D:\_w\1\b\bin\amd64\python311.pdb source: winws1.exe, 00000003.00000002.2268959946.00007FFD93783000.00000002.00000001.01000000.00000004.sdmp, python311.dll.0.dr
      Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1q 5 Jul 2022built on: Thu Aug 18 20:15:42 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-1_1"not available source: winws1.exe, 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmp
      Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: winws1.exe, 00000000.00000003.2205224817.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2281709657.00007FFDA5495000.00000002.00000001.01000000.0000000C.sdmp
      Source: Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: winws1.exe, 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmp
      Source: VCRUNTIME140.dll.0.drStatic PE information: 0x8E79CD85 [Sat Sep 30 01:19:01 2045 UTC]
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF6113015E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6113015E0
      Source: md__mypyc.cp311-win_amd64.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x2d0f2
      Source: _win32sysloader.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x461e
      Source: pyarmor_runtime.pyd.0.drStatic PE information: real checksum: 0x9fa51 should be: 0xa7a13
      Source: win32trace.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x78df
      Source: pywintypes311.dll.0.drStatic PE information: real checksum: 0x0 should be: 0x24bee
      Source: win32api.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x27e47
      Source: _psutil_windows.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x1f645
      Source: win32ui.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x11d72e
      Source: md.cp311-win_amd64.pyd.0.drStatic PE information: real checksum: 0x0 should be: 0x8d57
      Source: pythoncom311.dll.0.drStatic PE information: real checksum: 0x0 should be: 0xa5763
      Source: winws1.exeStatic PE information: section name: /4
      Source: winws1.exeStatic PE information: section name: .xdata
      Source: libcrypto-1_1.dll.0.drStatic PE information: section name: .00cfg
      Source: libssl-1_1.dll.0.drStatic PE information: section name: .00cfg
      Source: mfc140u.dll.0.drStatic PE information: section name: .didat
      Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
      Source: python311.dll.0.drStatic PE information: section name: PyRuntim
      Source: pyarmor_runtime.pyd.0.drStatic PE information: section name: .xdata
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65662C28 push rax; retf 9381h3_2_65662C31

      Persistence and Installation Behavior

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Users\user\Desktop\winws1.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d3_2_655D2390
      Source: C:\Users\user\Desktop\winws1.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d3_2_655D1FE0
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140_1.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\libssl-1_1.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\mfc140u.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\python311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pythoncom311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_decimal.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_hashlib.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_uuid.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\python3.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32trace.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_bz2.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\libcrypto-1_1.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\libffi-8.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\select.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_queue.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\_win32sysloader.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\win32ui.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_lzma.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil\_psutil_windows.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000\pyarmor_runtime.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_ssl.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pywintypes311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32api.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\_ctypes.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file

      Boot Survival

      barindex
      Contains functionality to infect the boot sector
      Source: C:\Users\user\Desktop\winws1.exeCode function: memset,wsprintfA,CreateFileA,memset,DeviceIoControl,CloseHandle,isxdigit,isxdigit,isxdigit,isprint,memcpy,CloseHandle,strlen,memcpy, \\.\PhysicalDrive%d3_2_655D2390
      Source: C:\Users\user\Desktop\winws1.exeCode function: _snprintf,_snprintf,CreateFileA,CreateFileA,GlobalAlloc,DeviceIoControl,GlobalFree,_snprintf,CreateFileA,GlobalAlloc,GlobalAlloc,GlobalAlloc,DeviceIoControl,GlobalFree,GlobalFree,GlobalFree,CloseHandle,GlobalFree,GlobalFree,GlobalFree,GlobalFree,CloseHandle, \\.\PhysicalDrive%d3_2_655D1FE0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611307680 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF611307680
      Source: C:\Users\user\Desktop\winws1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Yara detected AntiVM5
      Source: Yara matchFile source: 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: winws1.exe PID: 5392, type: MEMORYSTR
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B572C rdtsc 3_2_00007FFD930B572C
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\mfc140u.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\python311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pythoncom311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_decimal.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_hashlib.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_uuid.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\python3.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32trace.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_bz2.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md__mypyc.cp311-win_amd64.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\select.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_queue.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\_win32sysloader.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\win32ui.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_lzma.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil\_psutil_windows.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000\pyarmor_runtime.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_ssl.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pywintypes311.dllJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32api.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md.cp311-win_amd64.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57762\_ctypes.pydJump to dropped file
      Source: C:\Users\user\Desktop\winws1.exeAPI coverage: 3.6 %
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF6113093B0 FindFirstFileExW,FindClose,0_2_00007FF6113093B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611329618 FindFirstFileExW,0_2_00007FF611329618
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF6113093B0 FindFirstFileExW,FindClose,3_2_00007FF6113093B0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611329618 FindFirstFileExW,3_2_00007FF611329618
      Source: winws1.exe, 00000000.00000003.2207638760.000001F33E4C1000.00000004.00000020.00020000.00000000.sdmp, cacert.pem.0.drBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
      Source: winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE759B2000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE75910000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE759B2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: cacert.pem.0.drBinary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd

      Anti Debugging

      barindex
      Potentially malicious time measurement code found
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B572C3_2_00007FFD930B572C
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B42413_2_00007FFD930B4241
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B572C rdtsc 3_2_00007FFD930B572C
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655C2C80 PyEval_GetGlobals,PyFunction_NewWithQualName,_PyObject_CallFunction_SizeT,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,GetProcAddress,strlen,IsDebuggerPresent,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_RuntimeError,PyErr_Format,PyExc_SystemExit,PyExc_SystemExit,PyExc_SystemExit,_errno,_errno,_errno,PyExc_SystemExit,_errno,_errno,_Py_Dealloc,_Py_Dealloc,3_2_655C2C80
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF6113015E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6113015E0
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_655D4710 GetComputerNameA,GetProcessHeap,GetProcessHeap,HeapAlloc,HeapAlloc,GetAdaptersAddresses,HeapFree,strlen,GetProcessHeap,HeapFree,malloc,GetAdaptersAddresses,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersAddresses,RegOpenKeyExA,RegEnumKeyExA,RegEnumKeyExA,RegGetValueA,strlen,memcmp,RegGetValueA,RegCloseKey,3_2_655D4710
      Source: C:\Users\user\Desktop\winws1.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeCode function: 0_2_00007FF611301154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,0_2_00007FF611301154
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_656633B8 SetUnhandledExceptionFilter,3_2_656633B8
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_65641291 SetUnhandledExceptionFilter,3_2_65641291
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_6563F900 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,3_2_6563F900
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FF611301154 Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,exit,_cexit,3_2_00007FF611301154
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_00007FFD930B5A1F IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFD930B5A1F
      Source: C:\Users\user\Desktop\winws1.exeProcess created: C:\Users\user\Desktop\winws1.exe "C:\Users\user\Desktop\winws1.exe"Jump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_ctypes.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\certifi VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\libffi-8.dll VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\libssl-1_1.dll VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\python3.dll VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\select.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140_1.dll VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_bz2.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_lzma.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pythoncom311.dll VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000\pyarmor_runtime.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\select.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_ssl.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_hashlib.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_queue.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md.cp311-win_amd64.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md__mypyc.cp311-win_amd64.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\certifi\cacert.pem VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\_uuid.pyd VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\win32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32 VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p\gen_py\__init__.py VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p\gen_py\dicts.dat VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeQueries volume information: C:\Users\user\Desktop\winws1.exe VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\winws1.exeCode function: 3_2_6563F820 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,3_2_6563F820

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
      Native API      		1
      Bootkit      		11
      Process Injection      		11
      Process Injection      		OS Credential Dumping1
      System Time Discovery      		Remote Services1
      Archive Collected Data      		22
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Deobfuscate/Decode Files or Information      		LSASS Memory31
      Security Software Discovery      		Remote Desktop ProtocolData from Removable Media1
      Ingress Tool Transfer      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)2
      Obfuscated Files or Information      		Security Account Manager1
      System Network Configuration Discovery      		SMB/Windows Admin SharesData from Network Shared Drive1
      Non-Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact
      Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
      Bootkit      		NTDS1
      File and Directory Discovery      		Distributed Component Object ModelInput Capture2
      Application Layer Protocol      		Traffic DuplicationData Destruction
      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
      Timestomp      		LSA Secrets12
      System Information Discovery      		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
      DLL Side-Loading      		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      winws1.exe50%ReversingLabsWin64.Adware.RedCap
      winws1.exe100%AviraHEUR/AGEN.1354936

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\mfc140u.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\win32ui.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140_1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_bz2.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_ctypes.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_decimal.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_hashlib.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_lzma.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_queue.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_ssl.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\_uuid.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md.cp311-win_amd64.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md__mypyc.cp311-win_amd64.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\libcrypto-1_1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\libffi-8.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\libssl-1_1.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\psutil\_psutil_windows.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000\pyarmor_runtime.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\python3.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\python311.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pythoncom311.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pywintypes311.dll0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\select.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\win32\_win32sysloader.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32api.pyd0%ReversingLabs
      C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32trace.pyd0%ReversingLabs

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://www.opensource.org/licenses/mit-license.phptrols0%Avira URL Cloudsafe
      http://9x9o.com/ss122007.txt0%Avira URL Cloudsafe
      https://requests.readthedocs.io00%Avira URL Cloudsafe
      https://bugs.python.org/issue42195.0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      api.ipify.org
      		104.26.12.205
      		truefalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://github.com/giampaolo/psutil/issues/875.winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          https://requests.readthedocs.io0winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          https://github.com/urllib3/urllib3/issues/216winws1.exe, 00000003.00000003.2236513135.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://9x9o.com/ss122007.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://github.com/mhammond/pywin32winws1.exe, winws1.exe, 00000003.00000002.2277723700.00007FFDA3461000.00000002.00000001.01000000.0000000E.sdmp, winws1.exe, 00000003.00000002.2278571156.00007FFDA3514000.00000002.00000001.01000000.0000000D.sdmp, winws1.exe, 00000003.00000002.2274605182.00007FFD9DFE1000.00000002.00000001.01000000.0000000B.sdmp, win32api.pyd.0.dr, win32trace.pyd.0.dr, win32ui.pyd.0.drfalse
              		high
              https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://www.opensource.org/licenses/mit-license.phptrolswinws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://goo.gl/zeJZl.winws1.exe, 00000003.00000003.2233299071.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234597826.000001EE75A44000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234530611.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75A33000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://tools.ietf.org/html/rfc2388#section-4.4winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://www.quovadisglobal.com/cpsaVwinws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64winws1.exe, 00000003.00000003.2240403329.000001EE75A2F000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240301436.000001EE75A23000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        http://www.opensource.org/licenses/mit-license.phpwinws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE76151000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963winws1.exe, 00000003.00000002.2266031231.000001EE761C0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://peps.python.org/pep-0205/winws1.exe, 00000003.00000002.2264660625.000001EE752C0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://crl.dhimyotis.com/certignarootca.crlwinws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://curl.haxx.se/rfc/cookie_spec.htmlwinws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2241708243.000001EE75FAE000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266330558.000001EE764C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244602379.000001EE75FB3000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://ocsp.accv.eswinws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://github.com/urllib3/urllib3/issues/3020winws1.exe, 00000003.00000003.2236513135.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://raw.githubusercontent.com/gabjohn3/nb/main/pc_platforms.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		high
                                        https://google.com/api/195988555454cached__winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxywinws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688winws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264660625.000001EE75348000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              https://httpbin.org/getwinws1.exe, 00000003.00000002.2266330558.000001EE764C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		high
                                                https://raw.githubusercontent.com/gabjohn3/nb/main/mac_list.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://wwww.certigna.fr/autorites/0mwinws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerwinws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.cert.fnmt.es/dpcs/1t#winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://mail.python.org/pipermail/python-dev/2012-June/120787.html.winws1.exe, 00000003.00000003.2234597826.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75ACF000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234597826.000001EE75A44000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2234530611.000001EE75AD0000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2233299071.000001EE75A33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://httpbin.org/winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txt0winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://wwww.certigna.fr/autorites/winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlwinws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE759CA000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230534520.000001EE759C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244523998.000001EE75E49000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240991420.000001EE75E43000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sywinws1.exe, 00000003.00000003.2226170168.000001EE739E7000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264378119.000001EE738A1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228474249.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2229614156.000001EE738D1000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://raw.githubusercontent.com/gabjohn3/nb/main/DiskDrive_Serial_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://www.python.org/psf/license/winws1.exe, 00000003.00000002.2269198177.00007FFD93818000.00000004.00000001.01000000.00000004.sdmp, python311.dll.0.drfalse
                                                                            		high
                                                                            http://crl.securetrust.com/STCA.crlewinws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://crl.securetrust.com/STCA.crlwinws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://wwwsearch.sf.net/):winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2241708243.000001EE75FAE000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244602379.000001EE75FB3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://ipinfo.io/winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.accv.es/legislacion_c.htmwinws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://tools.ietf.org/html/rfc6125#section-6.4.3winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://crl.xrampsecurity.com/XGCA.crl0winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.cert.fnmt.es/dpcs/winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://google.com/mailwinws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE75910000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://packaging.python.org/specifications/entry-points/winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266212495.000001EE763C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://www.accv.es00winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pywinws1.exe, 00000003.00000003.2231508099.000001EE738C9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmwinws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE759CA000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230534520.000001EE759C6000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://foss.heptapod.net/pypy/pypy/-/issues/3539winws1.exe, 00000003.00000002.2266031231.000001EE761C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://google.com/winws1.exe, 00000003.00000003.2240225562.000001EE75AC5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242671953.000001EE75AB5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244418170.000001EE75AC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://mahler:8092/site-updates.pywinws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2243831229.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://crl.securetrust.com/SGCA.crlwinws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://.../back.jpegwinws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244289625.000001EE75FD8000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266330558.000001EE76568000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244480093.000001EE75EC2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://www.python.org/download/releases/2.3/mro/.winws1.exe, 00000003.00000003.2229717057.000001EE75749000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264660625.000001EE752C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2228526070.000001EE75757000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalse
                                                                                                                      		high
                                                                                                                      https://httpbin.org/postwinws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://raw.githubusercontent.com/gabjohn3/nb/main/ip_list.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://github.com/Ousret/charset_normalizerwinws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://www.firmaprofesional.com/cps0winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://github.com/urllib3/urllib3/issues/2920winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://crl.securetrust.com/SGCA.crl0winws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Manufacturer_List.txtpyd0winws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://yahoo.com/winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE75910000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://crl.securetrust.com/STCA.crl0winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://raw.githubusercontent.com/gabjohn3/nb/main/hwid_list.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://raw.githubusercontent.com/gabjohn3/nb/main/BIOS_Serial_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://api.ipify.orgwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E25000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239379563.000001EE75E84000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240991420.000001EE75E43000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://html.spec.whatwg.org/multipage/winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://www.quovadisglobal.com/cps0winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crlwinws1.exe, 00000003.00000002.2265424392.000001EE75EE2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningswinws1.exe, 00000003.00000002.2266115396.000001EE762C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://raw.githubusercontent.com/gabjohn3/nb/main/MachineGuid.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://www.rfc-editor.org/rfc/rfc8259#section-8.1winws1.exe, 00000003.00000003.2242671953.000001EE75AB5000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://www.iana.org/time-zones/repository/tz-link.htmlwinws1.exe, 00000003.00000003.2231035265.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230561158.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2230455090.000001EE75A23000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2231133560.000001EE75925000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://raw.githubusercontent.com/gabjohn3/nb/main/HwProfileGuid_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://requests.readthedocs.iowinws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2266470651.000001EE76600000.00000004.00001000.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://repository.swisssign.com/winws1.exe, 00000003.00000002.2265424392.000001EE75FB9000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE76070000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://api.ipify.org/winws1.exe, 00000003.00000002.2267484754.000001EE76F68000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://raw.githubusercontent.com/gabjohn3/nb/main/CPU_Serial_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://crl.xrampsecurity.com/XGCA.crlwinws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.python.orgwinws1.exe, 00000003.00000003.2237770651.000001EE75A18000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2236513135.000001EE75A0D000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2237770651.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2240154677.000001EE75AA3000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238285987.000001EE75A90000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2239299568.000001EE75A90000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://www.accv.es/legislacion_c.htm0Uwinws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://crl.securetrust.com/SGCA.crldwinws1.exe, 00000003.00000002.2264865831.000001EE75700000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    http://ocsp.accv.es0winws1.exe, 00000003.00000002.2265424392.000001EE75F16000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://www.python.org/winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2243831229.000001EE75F26000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75FA5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://json.orgwinws1.exe, 00000003.00000003.2240686911.000001EE75E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://twitter.com/winws1.exe, 00000003.00000003.2243831229.000001EE75F8E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244629038.000001EE75E33000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2242071793.000001EE75F94000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2244565857.000001EE75F9E000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265424392.000001EE75E25000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://stackoverflow.com/questions/4457745#4457745.winws1.exe, 00000003.00000002.2265345694.000001EE75CC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://www.quovadisglobal.com/cpswinws1.exe, 00000003.00000002.2265424392.000001EE75E50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://google.com/winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  https://google.com/mail/winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://raw.githubusercontent.com/gabjohn3/nb/main/BaseBoard_Serial_List.txtwinws1.exe, 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://bugs.python.org/issue42195.winws1.exe, 00000003.00000003.2238188206.000001EE75E66000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000003.2238736422.000001EE7597C000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2264865831.000001EE7570C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      http://google.com/mail/winws1.exe, 00000003.00000003.2240403329.000001EE75A70000.00000004.00000020.00020000.00000000.sdmp, winws1.exe, 00000003.00000002.2265054149.000001EE759EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high

                                                                                                                                                                                                        World Map of Contacted IPs

                                                                                                                                                                                                        • No. of IPs < 25%
                                                                                                                                                                                                        • 25% < No. of IPs < 50%
                                                                                                                                                                                                        • 50% < No. of IPs < 75%
                                                                                                                                                                                                        • 75% < No. of IPs

                                                                                                                                                                                                        Public IPs

                                                                                                                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                        104.26.12.205
                                                                                                                                                                                                        		api.ipify.orgUnited States
                                                                                                                                                                                                        		13335CLOUDFLARENETUSfalse

                                                                                                                                                                                                        General Information

                                                                                                                                                                                                        Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                        Analysis ID:1576658
                                                                                                                                                                                                        Start date and time:2024-12-17 11:28:12 +01:00
                                                                                                                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                                                                                                                        Overall analysis duration:0h 8m 7s
                                                                                                                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                                                                                                                        Report type:full
                                                                                                                                                                                                        Cookbook file name:default.jbs
                                                                                                                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                        Number of analysed new started processes analysed:19
                                                                                                                                                                                                        Number of new started drivers analysed:0
                                                                                                                                                                                                        Number of existing processes analysed:0
                                                                                                                                                                                                        Number of existing drivers analysed:0
                                                                                                                                                                                                        Number of injected processes analysed:0
                                                                                                                                                                                                        Technologies:
                                                                                                                                                                                                        • HCA enabled
                                                                                                                                                                                                        • EGA enabled
                                                                                                                                                                                                        • AMSI enabled
                                                                                                                                                                                                        Analysis Mode:default
                                                                                                                                                                                                        Analysis stop reason:Timeout
                                                                                                                                                                                                        Sample name:winws1.exe
                                                                                                                                                                                                        Detection:MAL
                                                                                                                                                                                                        Classification:mal76.evad.winEXE@3/34@1/1
                                                                                                                                                                                                        EGA Information:
                                                                                                                                                                                                        • Successful, ratio: 100%
                                                                                                                                                                                                        HCA Information:
                                                                                                                                                                                                        • Successful, ratio: 82%
                                                                                                                                                                                                        • Number of executed functions: 58
                                                                                                                                                                                                        • Number of non-executed functions: 206
                                                                                                                                                                                                        Cookbook Comments:
                                                                                                                                                                                                        • Found application associated with file extension: .exe

                                                                                                                                                                                                        Warnings

                                                                                                                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                                                                                                                                                                                                        • Excluded IPs from analysis (whitelisted): 184.28.90.27, 40.126.53.8, 20.223.35.26, 13.107.246.63, 20.199.58.43, 2.16.158.169, 172.202.163.200, 150.171.27.10, 20.103.156.88
                                                                                                                                                                                                        • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net
                                                                                                                                                                                                        • VT rate limit hit for: winws1.exe

                                                                                                                                                                                                        Simulations

                                                                                                                                                                                                        Behavior and APIs

                                                                                                                                                                                                        ⊘No simulations

                                                                                                                                                                                                        Joe Sandbox View / Context

                                                                                                                                                                                                        IPs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        104.26.12.205jgbC220X2U.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/?format=text
                                                                                                                                                                                                        xKvkNk9SXR.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        GD8c7ARn8q.exeGet hashmaliciousTrojanRansomBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        8AbMCL2dxM.exeGet hashmaliciousRCRU64, TrojanRansomBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        Simple2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        Yc9hcFC1ux.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        6706e721f2c06.exeGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        perfcc.elfGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                        • api.ipify.org/
                                                                                                                                                                                                        SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exeGet hashmaliciousRDPWrap ToolBrowse
                                                                                                                                                                                                        • api.ipify.org/

                                                                                                                                                                                                        Domains

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        api.ipify.orgKASHI SHIP PARTICULARS.pdf.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        PO.bat.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        rDOC24INV0616.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        PqCznDthHP.exeGet hashmaliciousEdge StealerBrowse
                                                                                                                                                                                                        • 104.26.13.205
                                                                                                                                                                                                        https://www.canva.com/design/DAGZLdpMEGI/O58JBUDFuRvFcdZ0tgIwgA/edit?utm_content=DAGZLdpMEGI&utm_campaign=designshare&utm_medium=link2&utm_source=sharebuttonGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                        https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        duschno.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                                                                                                                                                                                        • 172.67.74.152
                                                                                                                                                                                                        chos.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        • 104.26.12.205
                                                                                                                                                                                                        http://ap2vxmyqxf.ballyentoe.shopGet hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                                                                                                                                                        • 104.26.12.205

                                                                                                                                                                                                        ASNs

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        CLOUDFLARENETUShttps://aweitapp.com/zeng/advance/authGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        • 104.18.95.41
                                                                                                                                                                                                        https://eol-group.jimdosite.com/?utm_source=newsletter&utm_medium=email&utm_campaign=ceGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                        • 162.159.128.70
                                                                                                                                                                                                        file.exeGet hashmaliciousAmadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, XmrigBrowse
                                                                                                                                                                                                        • 172.67.129.27
                                                                                                                                                                                                        jYd7FUgGZc.exeGet hashmaliciousLummaC, StealcBrowse
                                                                                                                                                                                                        • 188.114.96.6
                                                                                                                                                                                                        sfWmEoGJQR.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                        • 172.67.129.27
                                                                                                                                                                                                        V65xPrgEHH.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                        • 104.21.2.110
                                                                                                                                                                                                        pN6iTXbhhc.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                        • 172.67.129.27
                                                                                                                                                                                                        81eivTbdp6.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                        • 104.21.2.110
                                                                                                                                                                                                        greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.htaGet hashmaliciousCobalt Strike, RemcosBrowse
                                                                                                                                                                                                        • 172.67.187.200
                                                                                                                                                                                                        hpEAJnNwCB.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                        • 104.21.56.70

                                                                                                                                                                                                        JA3 Fingerprints

                                                                                                                                                                                                        ⊘No context

                                                                                                                                                                                                        Dropped Files

                                                                                                                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\mfc140u.dllzapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          zapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            discord.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              main.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                zapret.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                    Payload.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                      SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                        SecuriteInfo.com.Python.Stealer.1251.9496.6786.exeGet hashmaliciousPython Stealer, BLX Stealer, XLABB GrabberBrowse
                                                                                                                                                                                                                          SecuriteInfo.com.FileRepMalware.25861.18393.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                            Created / dropped Files

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\mfc140u.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5653536
                                                                                                                                                                                                                            Entropy (8bit):6.729079283804055
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:ULnsrdZXUTQyJa9qgUUjlQNXkW8GCBTDgHsYogTYn3s3pQMqSj+vTCfEs7ATWYls:UoJUEUYS3zUQFLOAkGkzdnEVomFHKnP+
                                                                                                                                                                                                                            MD5:CD1D99DF975EE5395174DF834E82B256
                                                                                                                                                                                                                            SHA1:F395ADA2EFC6433B34D5FBC5948CB47C7073FA43
                                                                                                                                                                                                                            SHA-256:D8CA1DEA862085F0204680230D29BFF4D168FFF675AB4700EEAF63704D995CB3
                                                                                                                                                                                                                            SHA-512:397F725E79CA2C68799CF68DFB111A1570427F3D2175D740758C387BDAA508BC9014613E997B92FC96E884F66BB17F453F8AA035731AFD022D9A4E7095616F87
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Joe Sandbox View:
                                                                                                                                                                                                                            • Filename: zapret.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: zapret.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: discord.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: main.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: zapret.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: Payload.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.Python.Stealer.1251.9496.6786.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            • Filename: SecuriteInfo.com.FileRepMalware.25861.18393.exe, Detection: malicious, Browse
                                                                                                                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d...9.:e.........." .....(-..X)......X,.......................................V.....&~V...`A..........................................:.....h.;.......?......`=..8....V. (...PU.0p..P.5.T...........................`...8............@-.P...(.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\Pythonwin\win32ui.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1143296
                                                                                                                                                                                                                            Entropy (8bit):6.0410832425584795
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:dk6co2gGIs7ZetrV6LMEsKK+Onc8fUqzFVVppS6yZAXz:dkG2QQetrgsK79qzFHL
                                                                                                                                                                                                                            MD5:F0116137D0674482247D056642DC06BF
                                                                                                                                                                                                                            SHA1:5BB63FCF5E569D94B61383D1921F758BCC48EF81
                                                                                                                                                                                                                            SHA-256:8ECA3ED313003D3F3DEE1B7A5CE90B50E8477EC6E986E590E5ED91C919FC7564
                                                                                                                                                                                                                            SHA-512:A8D6420C491766302C615E38DAF5D9B1698E5765125FD256530508E5C0A5675A7BF2F338A22368E0B4DDFA507D8D377507376C477CF9B829E28F3C399203CDE6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.K.K...K...K...3]..K..Y>...K.......K...3...K...>...K...>...K...>...K...K...M...>...K..Y>...K..Y>...K..Y>1..K..Y>...K..Rich.K..........................PE..d......g.........." .........r......4.....................................................`.........................................`....T..hr..h...............................l\......T.......................(.......8................0...........................text............................... ..`.rdata..|...........................@..@.data...............................@....pdata...............d..............@..@.rsrc...............................@..@.reloc..l\.......^..................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):109392
                                                                                                                                                                                                                            Entropy (8bit):6.643764685776923
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
                                                                                                                                                                                                                            MD5:870FEA4E961E2FBD00110D3783E529BE
                                                                                                                                                                                                                            SHA1:A948E65C6F73D7DA4FFDE4E8533C098A00CC7311
                                                                                                                                                                                                                            SHA-256:76FDB83FDE238226B5BEBAF3392EE562E2CB7CA8D3EF75983BF5F9D6C7119644
                                                                                                                                                                                                                            SHA-512:0B636A3CDEFA343EB4CB228B391BB657B5B4C20DF62889CD1BE44C7BEE94FFAD6EC82DC4DB79949EDEF576BFF57867E0D084E0A597BF7BF5C8E4ED1268477E88
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........u...u...u.E.t...u.....u...t...u..v...u..q...u..p...u..u...u......u..w...u.Rich..u.........PE..d.....y..........." ...".....`.......................................................5....`A........................................`C..4....K...............p.......\..PO...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......D..............@....pdata.......p.......H..............@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\VCRUNTIME140_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):49488
                                                                                                                                                                                                                            Entropy (8bit):6.652691609629867
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:8EgYXUcHJcUJSDW/tfxL1qBS3hO6nb/TEHEXi9zufUKQXi9zug:8vGS8fZ1eUpreA+zuTc+zug
                                                                                                                                                                                                                            MD5:BBA9680BC310D8D25E97B12463196C92
                                                                                                                                                                                                                            SHA1:9A480C0CF9D377A4CAEDD4EA60E90FA79001F03A
                                                                                                                                                                                                                            SHA-256:E0B66601CC28ECB171C3D4B7AC690C667F47DA6B6183BFF80604C84C00D265AB
                                                                                                                                                                                                                            SHA-512:1575C786AC3324B17057255488DA5F0BC13AD943AC9383656BAF98DB64D4EC6E453230DE4CD26B535CE7E8B7D41A9F2D3F569A0EFF5A84AEB1C2F9D6E3429739
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Reputation:moderate, very likely benign file
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............L...L...L...M...L...M...L.FL...L...L...L...M...L...M...L...M...L...M...L..*L...L...M...LRich...L........................PE..d...%CU..........." ...".<...8.......A...............................................@....`A........................................0m.......m..x....................r..PO......D....c..p...........................pb..@............P..h............................text...0:.......<.................. ..`.rdata..."...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_bz2.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):83320
                                                                                                                                                                                                                            Entropy (8bit):6.534357225224291
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:KouLz7p5TcaWlZkKWVa5cP6T8MsAUxZIgtVt7SyKrPxji2:JuLz9tVaDQMslxZIgtVtozxj/
                                                                                                                                                                                                                            MD5:10D42EFAC304861AD19821B4594FA959
                                                                                                                                                                                                                            SHA1:1A65F60BBA991BC7E9322AF1E19F193DAE76D77A
                                                                                                                                                                                                                            SHA-256:8EECDCC250637652E6BABC306EA6B8820E9E835DDD2434816D0E0FD0CA67FD14
                                                                                                                                                                                                                            SHA-512:3F16DBA627A133586E9D1C16D383B9461424D31892278AB984F7E6932A1CDC51445E1BEC017A665BD66C0F2A9BA417387FECC5FDEDE36D67F8343B82A2CEB9AE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................a.........................................t.........................................Rich....................PE..d...j..c.........." ...".....^......,........................................P............`.........................................p...H............0....... .. .......x)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_ctypes.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):123256
                                                                                                                                                                                                                            Entropy (8bit):5.999431491646041
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:aBxSn2prY3+52vWqw9RQfLIgRr5kNIgQPUZxhT:acuY3+uWHQfLIIkFT
                                                                                                                                                                                                                            MD5:DF6BE515E183A0E4DBE9CDDA17836664
                                                                                                                                                                                                                            SHA1:A5E8796189631C1AACA6B1C40BC5A23EB20B85DB
                                                                                                                                                                                                                            SHA-256:AF598AE52DDC6869F24D36A483B77988385A5BBBF4618B2E2630D89D10A107EE
                                                                                                                                                                                                                            SHA-512:B3F23530DE7386CC4DCF6AD39141240E56D36322E3D4041E40D69D80DD529D1F8EF5F65B55CDCA9641E378603B5252ACFE5D50F39F0C6032FD4C307F73EF9253
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................................................u.................D........?...u.....u.....u.x....u.....Rich...........................PE..d...p..c.........." ...".............\..............................................Z"....`..........................................P.......Q..........................x)..............T...........................`...@............................................text............................... ..`.rdata...l.......n..................@..@.data...$=...p...8...`..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_decimal.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):251768
                                                                                                                                                                                                                            Entropy (8bit):6.5390336301750915
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:3Zu25e1itIj95vlqyhw+H8DOdKd2vk6LhKwwI9qWM53pLW1AxzwhtTYW3iQ:Jhe1oIj7vlpN8D0KA3swwJ/wzTYWf
                                                                                                                                                                                                                            MD5:A1FFC2A156E9266932C351A88E5E7FAB
                                                                                                                                                                                                                            SHA1:EBFC901C28035264FBB5B0F30E68AB3B45410D13
                                                                                                                                                                                                                            SHA-256:B8409829DC4FDE70F38754DE55D3090A1CD52C78FFECE2A08572A58DE3AF294D
                                                                                                                                                                                                                            SHA-512:74FECAAC362DEFF5139EA8553142BA7E8A7740B757A06EDF16CF4A9320A20E7A1567380BFE2F40A3B7E8508F9715EFEDF27C6C23D2B2FB3ED7664CB81F6D58D9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........|RTy..Ty..Ty..]...Zy......Vy......Yy......\y......Py......Wy......Vy..Ty...y......Uy......[y......Uy......Uy......Uy..RichTy..........PE..d...]..c.........." ...".v...<......................................................".....`..........................................S..P...@T...................&......x)......P.......T...........................@...@............................................text....u.......v.................. ..`.rdata...............z..............@..@.data....*...p...$...R..............@....pdata...&.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_hashlib.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):63864
                                                                                                                                                                                                                            Entropy (8bit):6.167124957336244
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:aS8njpHxGkYjEbEJkn8cw6TxIg5Iyv7SyKPxk:InjpHxYJ8w6TxIg5IyvMxk
                                                                                                                                                                                                                            MD5:F419AC6E11B4138EEA1FE8C86689076A
                                                                                                                                                                                                                            SHA1:886CDA33FA3A4C232CAA0FA048A08380971E8939
                                                                                                                                                                                                                            SHA-256:441D32922122E59F75A728CC818F8E50613866A6C3DEC627098E6CC6C53624E2
                                                                                                                                                                                                                            SHA-512:6B5AA5F5FBC00FB48F49B441801EE3F3214BD07382444569F089EFB02A93CE907F6F4E0DF281BDA81C80F2D6A247B0ADC7C2384A2E484BC7EF43B43C84756D2B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.A.>...>...>...F2..>...B...>...B...>...B...>...B...>..iB...>...L...>...D...>...>..Q>..iB...>..iB...>..iB^..>..iB...>..Rich.>..........................PE..d...y..c.........." ...".T...~......@?..............................................T.....`.............................................P.......................,.......x)......\...0}..T............................{..@............p..(............................text...YR.......T.................. ..`.rdata...N...p...P...X..............@..@.data...8...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_lzma.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):157560
                                                                                                                                                                                                                            Entropy (8bit):6.834915161510991
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:jlirS97HrdVmEkGCm5heznf49mNo2OOvJ72ZIge1z7axC:jlirG0EkT7AYO2OQSE
                                                                                                                                                                                                                            MD5:3230404A7191C6228A8772D3610E49E5
                                                                                                                                                                                                                            SHA1:4E8E36C89B4FF440DDFF9A5B084B262C9B2394EC
                                                                                                                                                                                                                            SHA-256:33AE42F744D2688BB7D5519F32FF7B7489B96F4EEA47F66D2009DBA6A0023903
                                                                                                                                                                                                                            SHA-512:6ECCE0C8E8B3D42275D486E8FF495E81E36ADAAACAAA3DB37844E204FCDAA6D89CB3D81C43D9E16D938CD8B6671B8800FE74A1E723A9187B0566A8F3C39D5D5B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.*[&.D.&.D.&.D./...".D.i.E.$.D.i.A.*.D.i.@...D.i.G.%.D...E.%.D...E.$.D.&.E.@.D...I...D...D.'.D....'.D...F.'.D.Rich&.D.................PE..d...|..c.........." ...".b...........5...............................................0....`..........................................%..L...\%..x....p.......P.......>..x)......8.......T...........................p...@............................................text....a.......b.................. ..`.rdata..............f..............@..@.data........@......................@....pdata.......P......................@..@.rsrc........p.......2..............@..@.reloc..8............<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_queue.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):31096
                                                                                                                                                                                                                            Entropy (8bit):6.359436989118125
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:o+yFs6rXkmk5sNIg7UOYiSyvqdPxWEpnl:o+wNXkP5sNIg7UO7SySdPx7l
                                                                                                                                                                                                                            MD5:045EF55136B1E580582199B3399267A2
                                                                                                                                                                                                                            SHA1:DE54519C67A996D0A8B4164417058F4610A57376
                                                                                                                                                                                                                            SHA-256:39BD456267FE228A505EF4E9C8D28F948DD65123CB4D48B77DA51910013FA582
                                                                                                                                                                                                                            SHA-512:7B764FDC92BF10EB05BDD4116A549DE67F0FA92F807D8B0ECA9D718361C546DBEC16EA68EF8DDEC1C417530C6EB234C657E45F8C522852AB1BD7CB21976DAD1C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._XF.1.F.1.F.1.O..D.1...0.D.1...4.J.1...5.N.1...2.E.1...0.E.1...0.D.1.F.0...1...<.G.1...1.G.1.....G.1...3.G.1.RichF.1.................PE..d...^..c.........." ...".....8.......................................................?....`..........................................C..L....C..d....p.......`.......P..x)..........p4..T...........................03..@............0..0............................text............................... ..`.rdata..R....0......................@..@.data...x....P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_socket.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):78208
                                                                                                                                                                                                                            Entropy (8bit):6.237216760115608
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:/2JlcAdpEVuji9/s+S+pmGQRivVia3iNIgQw97Sy2Pxe:/27ce+uji9/sT+pmGdvVp3iNIgQw9cxe
                                                                                                                                                                                                                            MD5:0FC65EC300553D8070E6B44B9B23B8C0
                                                                                                                                                                                                                            SHA1:F8DB6AF578CF417CFCDDB2ED798C571C1ABD878F
                                                                                                                                                                                                                            SHA-256:360744663FCE8DEC252ABBDA1168F470244FDB6DA5740BB7AB3171E19106E63C
                                                                                                                                                                                                                            SHA-512:CBA375A815DB973B4E8BABDA951D1A4CA90A976E9806E9A62520A0729937D25DE8E600E79A7A638D77DF7F47001D8F884E88EE4497BD1E05C1DAE6FA67FB3DD8
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z..|4..|4..|4......|4...5..|4...1..|4...0..|4...7..|4...5..|4..|5..|4.y.5..|4...9..|4...4..|4......|4...6..|4.Rich.|4.........................PE..d...|..c.........." ...".l...........%.......................................P......3:....`.........................................@...P............0....... ..x........)...@..........T...............................@............................................text....k.......l.................. ..`.rdata..Dt.......v...p..............@..@.data...............................@....pdata..x.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_ssl.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):159616
                                                                                                                                                                                                                            Entropy (8bit):5.995615055409981
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:EFrIQQey4VWR98w/PQQcXobuO0rGxn+SQOXLkd1ItS+Q8YuAfxZIgt7YZx:0EeRV29//4QcCuO7nyvx
                                                                                                                                                                                                                            MD5:93905020F4158C5119D16EE6792F8057
                                                                                                                                                                                                                            SHA1:EB613C31F26ED6D80681815193FFAFDF30314A07
                                                                                                                                                                                                                            SHA-256:D9CC4358D9351FED11EEC03753A8FA8ED981A6C2246BBD7CB0B0A3472C09FDC4
                                                                                                                                                                                                                            SHA-512:0DE43B4FAFDD39EAAFF6CAB613708D56B697C0C17505E4132D652FB3F878C2114F5E682745A41219193C75E783AEDE524685B77BD31620F8AFE9C7B250F92609
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,z..h.g,h.g,h.g,ac.,n.g,'gf-j.g,'gb-e.g,'gc-`.g,'gd-k.g,.gf-j.g,.af-l.g,h.f,..g,.if-o.g,.gj-j.g,.gg-i.g,.g.,i.g,.ge-i.g,Richh.g,........PE..d......c.........." ..."............l+..............................................l.....`.............................................d............`.......P.......F...)...p..4... ...T...............................@...............x............................text............................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P......."..............@..@.rsrc........`......................@..@.reloc..4....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\_uuid.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):23936
                                                                                                                                                                                                                            Entropy (8bit):6.534526451093787
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:ofwFpEWx6TfQZIgewfAIYiSy1pCQwpxPxh8E9VF0Ny82e:oqpEHjQZIgewxYiSyvIPxWEuV
                                                                                                                                                                                                                            MD5:13CC10D148B921F68E218DD912CC6EE4
                                                                                                                                                                                                                            SHA1:930CEF88B581FB4D1B88FBDBAF64D34EFA582F90
                                                                                                                                                                                                                            SHA-256:D17E20063243A71B4331C7A8902451C6911FD87475EC918633C6388D6155CE52
                                                                                                                                                                                                                            SHA-512:8AF81D78A778875E63F99D7434724D772147DA7EC07B88FB7094C9DCD02B86D08CE2BB3D3EE94D8C62156D2BF8331562B8C91B5E36A1278B64D0B6FD7EFF45E6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;$p^ZJ#^ZJ#^ZJ#W".#\ZJ#.&K"\ZJ#.&O"RZJ#.&N"VZJ#.&I"]ZJ#.&K"\ZJ#.(K"[ZJ#^ZK#tZJ#.&B"_ZJ#.&J"_ZJ#.&.#_ZJ#.&H"_ZJ#Rich^ZJ#................PE..d...f..c.........." ...".....&...... ........................................p............`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\base_library.zip

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1437281
                                                                                                                                                                                                                            Entropy (8bit):5.590853297284865
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:24576:mQR5pATt7xm4lUKdcubgAnyfbTD0iwhBdYf9P3sGHH0:mQR5pQxmfjW
                                                                                                                                                                                                                            MD5:9DC12EA9F7821873DA74C772ABB280F0
                                                                                                                                                                                                                            SHA1:3F271C9F54BC7740B95EAA20DEBBD156EBD50760
                                                                                                                                                                                                                            SHA-256:C5EC59385BFAC2A0AC38ABF1377360CD1FDDD05C31F8A8B4E44252E0E63ACB10
                                                                                                                                                                                                                            SHA-512:A3175C170BBB28C199AB74AD3116E71F03F124D448BF0E9DD4AFCACDC08A7A52284CF858CFD7E72D35BD1E68C6BA0C2A1A0025199AEB671777977EA53E1F2535
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:PK..........!.h%..b...b......._collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\certifi\cacert.pem

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:ASCII text
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):299427
                                                                                                                                                                                                                            Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                            MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                            SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                            SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                            SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10752
                                                                                                                                                                                                                            Entropy (8bit):4.8208567868970675
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:96:Y0fK74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFuCQAAZWQcX6g8H4a81:gFCk2z1/t12iwU5usJFKCyHcqgg
                                                                                                                                                                                                                            MD5:CBF62E25E6E036D3AB1946DBAFF114C1
                                                                                                                                                                                                                            SHA1:B35F91EAF4627311B56707EF12E05D6D435A4248
                                                                                                                                                                                                                            SHA-256:06032E64E1561251EA3035112785F43945B1E959A9BF586C35C9EA1C59585C37
                                                                                                                                                                                                                            SHA-512:04B694D0AE99D5786FA19F03C5B4DD8124C4F9144CFE7CA250B48A3C0DE0883E06A6319351AE93EA95B55BBBFA69525A91E9407478E40AD62951F1D63D45FF18
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................X......o..............o.......o.......o......j..............n......n......n4.....n......Rich....................PE..d....#.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):121344
                                                                                                                                                                                                                            Entropy (8bit):5.899699901799497
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:3Ives1m094QtwqlaZTwuQMS/Pf+vGTVmEU:3PsQIJmE
                                                                                                                                                                                                                            MD5:BAC273806F46CFFB94A84D7B4CED6027
                                                                                                                                                                                                                            SHA1:773FBC0435196C8123EE89B0A2FC4D44241FF063
                                                                                                                                                                                                                            SHA-256:1D9ABA3FF1156EA1FBE10B8AA201D4565AE6022DAF2117390D1D8197B80BB70B
                                                                                                                                                                                                                            SHA-512:EAEC1F072C2C0BC439AC7B4E3AEA6E75C07BD4CD2D653BE8500BBFFE371FBFE045227DAEAD653C162D972CCAADFF18AC7DA4D366D1200618B0291D76E18B125C
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........yB............................................................................................Rich...........................PE..d....#.g.........." ...).2..........@4.......................................0............`.............................................d...d...................p............ ......@...................................@............P...............................text...x0.......2.................. ..`.rdata...Y...P...Z...6..............@..@.data....=.......0..................@....pdata..p...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\libcrypto-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):3441504
                                                                                                                                                                                                                            Entropy (8bit):6.097985120800337
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:49152:8TKuk2CQIU6iV9OjPWgBqIVRIaEv5LY/RnQ2ETEvrPnkbsYNPsNwsML1CPwDv3u6:Vv+KRi5KsEKsY+NwsG1CPwDv3uFfJu
                                                                                                                                                                                                                            MD5:6F4B8EB45A965372156086201207C81F
                                                                                                                                                                                                                            SHA1:8278F9539463F0A45009287F0516098CB7A15406
                                                                                                                                                                                                                            SHA-256:976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
                                                                                                                                                                                                                            SHA-512:2C5C54842ABA9C82FB9E7594AE9E264AC3CBDC2CC1CD22263E9D77479B93636799D0F28235AC79937070E40B04A097C3EA3B7E0CD4376A95ED8CA90245B7891F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... ..$...................................................4....../5...`..........................................h/..h...*4.@....`4.|....`2.....Z4.`)...p4..O....,.8...........................`.,.@............ 4..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......`2.......1.............@..@.idata..^#... 4..$....3.............@..@.00cfg..u....P4.......3.............@..@.rsrc...|....`4.......3.............@..@.reloc...x...p4..z....3.............@..B................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\libffi-8.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):38232
                                                                                                                                                                                                                            Entropy (8bit):6.57967863494938
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
                                                                                                                                                                                                                            MD5:D86A9D75380FAB7640BB950AEB05E50E
                                                                                                                                                                                                                            SHA1:1C61AAF9022CD1F09A959F7B2A65FB1372D187D7
                                                                                                                                                                                                                            SHA-256:68FBA9DD89BFAD35F8FD657B9AF22A8AEBDA31BFFDA35058A7F5AE376136E89B
                                                                                                                                                                                                                            SHA-512:18437E64061221BE411A1587F634B4B8EFA60E661DBC35FD96A6D0E7EFF812752DE0ADA755C01F286EFEFC47FB5F2DAF07953B4CFC4119121B6BEE7756C88D0F
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.r...........................Y...........;....................................................Rich............PE..d....-c.........." ...!.H...(.......L....................................................`......................................... l.......p..P...............P....l..X)......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\libssl-1_1.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):702816
                                                                                                                                                                                                                            Entropy (8bit):5.547832370836076
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:UUnBMlBGdU/t0voUYHgqRJd7a7+JLvrfX7bOI8Fp0D6WuHU2lvzR:UN/t0vMnffOI8Fp0D6TU2lvzR
                                                                                                                                                                                                                            MD5:8769ADAFCA3A6FC6EF26F01FD31AFA84
                                                                                                                                                                                                                            SHA1:38BAEF74BDD2E941CCD321F91BFD49DACC6A3CB6
                                                                                                                                                                                                                            SHA-256:2AEBB73530D21A2273692A5A3D57235B770DAF1C35F60C74E01754A5DAC05071
                                                                                                                                                                                                                            SHA-512:FAC22F1A2FFBFB4789BDEED476C8DAF42547D40EFE3E11B41FADBC4445BB7CA77675A31B5337DF55FDEB4D2739E0FB2CBCAC2FEABFD4CD48201F8AE50A9BD90B
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .B...T......<.....................................................`.........................................@A...N..@U..........s........M......`)......h...0...8...............................@............@..@............................text....@.......B.................. ..`.rdata..J/...`...0...F..............@..@.data...AM.......D...v..............@....pdata...V.......X..................@..@.idata..%W...@...X..................@..@.00cfg..u............j..............@..@.rsrc...s............l..............@..@.reloc..l............t..............@..B................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\psutil\_psutil_windows.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):67072
                                                                                                                                                                                                                            Entropy (8bit):5.909456553599775
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:1536:j3sHmR02IvVxv7WCyKm7c5Th4JBHTOvyyaZE:jnIvryCyKx5Th4J5OvyyO
                                                                                                                                                                                                                            MD5:49AC12A1F10AB93FAFAB064FD0523A63
                                                                                                                                                                                                                            SHA1:3AD6923AB0FB5D3DD9D22ED077DB15B42C2FBD4F
                                                                                                                                                                                                                            SHA-256:BA033B79E858DBFCBA6BF8FB5AFE10DEFD1CB03957DBBC68E8E62E4DE6DF492D
                                                                                                                                                                                                                            SHA-512:1BC0F50E0BB0A9D9DDDAD31390E5C73B0D11C2B0A8C5462065D477E93FF21F7EDC7AA2B2B36E478BE0A797A38F43E3FBEB6AAABEF0BADEC1D8D16EB73DF67255
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......nT..*5..*5..*5..#M2. 5..x@..(5..x@..&5..x@.."5..x@...5...k..(5..aM..;5..*5...5...@..:5...@..+5...@^.+5...@..+5..Rich*5..................PE..d...._.g.........." .........h......\........................................@............`.........................................0...`.......@.... .......................0..(.......................................8............................................text...h........................... ..`.rdata..\I.......J..................@..@.data...x...........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..(....0......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\pyarmor_runtime_000000\pyarmor_runtime.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):631296
                                                                                                                                                                                                                            Entropy (8bit):6.203979773542914
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:1pE0yRzkaywctjdcg7fUoPM5pSOnE7G1:Cctjdcg7fUoPM5pSOnq
                                                                                                                                                                                                                            MD5:892A73390C93223518B1A7B5624F77D7
                                                                                                                                                                                                                            SHA1:9D02DEBA198F6FE4BE2FE429DA3556F9ED3AAB33
                                                                                                                                                                                                                            SHA-256:AD11E98C0EF951AC6E4AFD608D6BB2E7758157B838EE865F7499118A7E85E647
                                                                                                                                                                                                                            SHA-512:59B14B40F1B00A0C61884157EB37EE29C8BD3D9D20CCF2C2BB7BE75BFBABAFE6CAA6B5F15BDA82701C077A7E4EAB4A8895BD44425DFBA783C33639E167CDF836
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".............h..0.........\e....................................Q......... .........................................].... ..l4...........@...#.......................................... ...(...................h+...............................text...............................`.P`.data....E... ...F..................@.`..rdata.......p.......P..............@.`@.pdata...#...@...$..................@.0@.xdata...&...p...(...:..............@.0@.bss.....f............................`..edata..]............b..............@.0@.idata..l4... ...6...d..............@.0..CRT....X....`......................@.@..tls.........p......................@.@..reloc..............................@.0B........................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\python3.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):65912
                                                                                                                                                                                                                            Entropy (8bit):6.084559408369445
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:768:xw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS7:O/5k8cnzeJ4NIgQ0D7SyVPx5
                                                                                                                                                                                                                            MD5:7FEB3DA304A2FEAD0BB07D06C6C6A151
                                                                                                                                                                                                                            SHA1:EE4122563D9309926BA32BE201895D4905D686CE
                                                                                                                                                                                                                            SHA-256:DDD2C77222E2C693EF73D142422D6BF37D6A37DEEAD17E70741B0AC5C9FE095B
                                                                                                                                                                                                                            SHA-512:325568BCF1835DD3F454A74012F5D7C6877496068AD0C2421BF65E0640910AE43B06E920F4D0024277EEE1683F0CE27959843526D0070683DA0C02F1EAC0E7D2
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]{....e...e...e..fm...e..fe...e..f....e..fg...e.Rich..e.........................PE..d...S..c.........." ..."..................................................................`.........................................`...P...............................x)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\python311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):5761912
                                                                                                                                                                                                                            Entropy (8bit):6.088523424589967
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:98304:qvpgHup+dhRXLPw3W47SrSUHfMWdPrjUOYmIF:qvpgHup+XJrYWYWdjUOYmU
                                                                                                                                                                                                                            MD5:A72993488CECD88B3E19487D646F88F6
                                                                                                                                                                                                                            SHA1:5D359F4121E0BE04A483F9AD1D8203FFC958F9A0
                                                                                                                                                                                                                            SHA-256:AA1E959DCFF75A343B448A797D8A5A041EB03B27565A30F70FD081DF7A285038
                                                                                                                                                                                                                            SHA-512:C895176784B9AC89C9B996C02EC0D0A3F7CD6EBF653A277C20DEC104DA6A11DB084C53DD47C7B6653A448D877AD8E5E79C27DB4EA6365EBB8CA2A78AA9C61B38
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................................m....l.................y........................Rich....................PE..d...H..c.........." ...".\%..27.....|J........................................\.....}.X...`...........................................@.....|TA......p[.......V.X0....W.x)....[..B....).T.............................).@............p%..............................text....Z%......\%................. ..`.rdata.......p%......`%.............@..@.data.........A..L...jA.............@....pdata..X0....V..2....Q.............@..@PyRuntim......X.......S.............@....rsrc........p[......tV.............@..@.reloc...B....[..D...~V.............@..B................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pythoncom311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):670208
                                                                                                                                                                                                                            Entropy (8bit):6.035999626973864
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:ngSkceIv3zBJBQoXNi4LCQqAOffa1tpd5g:gSkc/v3zB9NiEWfa
                                                                                                                                                                                                                            MD5:31C1BF2ACA5DF417F6CE2618C3EEFE7E
                                                                                                                                                                                                                            SHA1:4C2F7FE265FF28396D03BA0CAB022BBD1785DBF2
                                                                                                                                                                                                                            SHA-256:1DAF7C87B48554F1481BA4431102D0429704832E42E3563501B1FFDD3362FCD1
                                                                                                                                                                                                                            SHA-512:5723145F718CC659ADD658BA545C5D810E7032842907BAB5C2335E3DE7F20FE69B58AA42512FD67EA8C6AA133E59E0C26BD90700BDD0D0171AF6C1E1C73A2719
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..~f..-f..-f..-o..-l..-4..,b..-4..,q..-4..,n..-4..,b..-...,d..--..,k..-...,d..--..,o..-f..-5..-...,7..-...,g..-...,g..-Richf..-................PE..d...&..g.........." ......................................................................`..........................................U...c..(...........l....@...z............... ..P...T...............................8............................................text............................... ..`.rdata..x$.......&..................@..@.data....I..........................@....pdata...z...@...|..................@..@.rsrc...l...........................@..@.reloc... ......."..................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\pywin32_system32\pywintypes311.dll

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):134656
                                                                                                                                                                                                                            Entropy (8bit):5.999117329459055
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:kLcVKY3tOSjPenBttgY/r06Yr27vJmxETaTX7wevxJ:kLcVKY3tOWPxY/rkqzJmxEmTXMev
                                                                                                                                                                                                                            MD5:5D67ABF69A8939D13BEFB7DE9889B253
                                                                                                                                                                                                                            SHA1:BCBBF88C05732D4E1E3811FD312425C1C92018D1
                                                                                                                                                                                                                            SHA-256:615EB8A75F9ED9371A59DA8F31E27EE091C013DB0B9164A5124CA0656EA47CB4
                                                                                                                                                                                                                            SHA-512:FA34EB05996C41F23524A8B4F1FAED0BDD41224D8E514AA57D568A55D2044C32798C1357F22C72AD79FD02948CAAD89B98B8E9B0AD2927E4A0169739335271CE
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I+.j'x.j'x.j'x...x.j'x..&y.j'x...x.j'x.."y.j'x..#y.j'x..$y.j'x..#y.j'x..&y.j'x..&y.j'x.j&xCj'xk..y.j'xk.'y.j'xk.%y.j'xRich.j'x................PE..d......g.........." ................,........................................P............`..........................................u..lB......,....0..l.......L............@..0....Q..T............................R..8............................................text...y........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\select.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):29056
                                                                                                                                                                                                                            Entropy (8bit):6.492672207841723
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:Ag1ecReJK4HquuI7A70RUZNIg7GXIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AseUeJRHqgbGNIg7GYYiSyvwMfPxWEo
                                                                                                                                                                                                                            MD5:116335EBC419DD5224DD9A4F2A765467
                                                                                                                                                                                                                            SHA1:482EF3D79BFD6B6B737F8D546CD9F1812BD1663D
                                                                                                                                                                                                                            SHA-256:813EEDE996FC08E1C9A6D45AAA4CBAE1E82E781D69885680A358B4D818CFC0D4
                                                                                                                                                                                                                            SHA-512:41DC7FACAB0757ED1E286AE8E41122E09738733AD110C2918F5E2120DFB0DBFF0DAEFCAD2BFFD1715B15B44C861B1DD7FB0D514983DB50DDC758F47C1B9B3BF3
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].t.<t'.<t'.<t'.D.'.<t'.@u&.<t'.@q&.<t'.@p&.<t'.@w&.<t'i@u&.<t'.<u'.<t'.Nu&.<t'i@y&.<t'i@t&.<t'i@.'.<t'i@v&.<t'Rich.<t'................PE..d...^..c.........." ...".....2.......................................................!....`..........................................@..L...,A..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\unicodedata.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):1139576
                                                                                                                                                                                                                            Entropy (8bit):5.430913356361142
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:12288:g32YbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ub:gGYbM00IDJcjEwPgPOG6Xyd461ub
                                                                                                                                                                                                                            MD5:CDB5F373D24ADCEB4DC4FA1677757F0C
                                                                                                                                                                                                                            SHA1:AF6B381EED65D244C57129346008EC8532BA336B
                                                                                                                                                                                                                            SHA-256:175C4CB528F1AC4E285C575CC3F5E85EC4B3AE88860210B5D795B580C7F0B5D9
                                                                                                                                                                                                                            SHA-512:429A326648C761BF068CA7735094644F532D631CF9355C9F1A5743A5791837A36CD6AA2EFE2265C7541FEB06310D0C07B634DD04438D8EDDBDF1C4147938A868
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..t..t..}...r..;...v..;...y..;...|..;...w.....w......v..t..%.....u.....u...y.u.....u..Richt..........PE..d...j..c.........." ...".@..........P*..............................................u.....`.............................................X............`.......P..0....:..x)...p.......]..T............................[..@............P..x............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data...H....0......................@....pdata..0....P.......&..............@..@.rsrc........`......................@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\win32\_win32sysloader.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):14848
                                                                                                                                                                                                                            Entropy (8bit):5.113812591033072
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:192:rCm72PEO1jIUs0YqEcPbF55UgCWV4rofnDPdRD0hvHvcqvn7ycIt/G/:rardA0Bzx14r6nDrOhv+O/
                                                                                                                                                                                                                            MD5:B58CA169FDCFFAB726391D3906DD9A4E
                                                                                                                                                                                                                            SHA1:C4BB8DA84A5D9C31D0ACB7A4127F55E696F414DF
                                                                                                                                                                                                                            SHA-256:1A8DCDBD730166889C03FAF285DC1DD9F16090DFE81043D80A9D6308300EBAC9
                                                                                                                                                                                                                            SHA-512:AA23DEBF80D89A40677D1BF1C7C6C3445A79E76419865B86D0D6A605656478067EBEA2752348FCF77D583D2E5DCD284DA7F55F751D6441E647565DA77F982966
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Dg..%..%..%..]..%...P..%...]..%...P..%...P..%...P..%.....%..%..%..LP..%..LP..%..LP..%..Rich.%..................PE..d......g.........." ......................................................................`..........................................;..`...p;..d....p..t....`..................@...|2..T............................2..8............0..p............................text............................... ..`.rdata..4....0......................@..@.data........P......................@....pdata.......`.......0..............@..@.rsrc...t....p.......4..............@..@.reloc..@............8..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32api.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):133120
                                                                                                                                                                                                                            Entropy (8bit):5.849201651779307
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3072:znvpE3JJ/Q7DspOCQUUU40Oc3lRVFhLaNzvBii7qQvmwCoY9LQPe:T4xG4pOCQUUU4rWlRVgv5qQSoY9
                                                                                                                                                                                                                            MD5:D02300D803850C3B0681E16130FECEE4
                                                                                                                                                                                                                            SHA1:6411815E2A908432A640719ECFE003B43BBBA35C
                                                                                                                                                                                                                            SHA-256:B938C8CD68B15EC62F053045A764D8DD38162A75373B305B4CF1392AC05DF5F9
                                                                                                                                                                                                                            SHA-512:6FAD1836614869AB3BB624BDA9943CEAF9E197B17CA4F4FFE78699492B72F95EEE02AE1BB07C0508438956BEF10CC1E656DDF75D0EDC9EF71A3860AF39075564
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..Vx...x...x...q...p...*..|...*..p...*..|......z.......z...*..o...3..s...x...-......z......y......y...Richx...........PE..d......g.........." .........................................................P............`.........................................P...............0..\....................@..X....v..T............................;..8............0.........@....................text............................... ..`.rdata..b....0......................@..@.data...X(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..X....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI57762\win32\win32trace.pyd

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):23552
                                                                                                                                                                                                                            Entropy (8bit):5.281874510289411
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:384:9eeH8ZmV+zknwMswDuVQO0T8DmMel2/QEVR7AWCq5yn9ukF1B3:N+zi/uVQ1Q/QEVR1NUpB
                                                                                                                                                                                                                            MD5:965E9833F4CD7A45C2C1EE85EFC2DA3B
                                                                                                                                                                                                                            SHA1:3C6888194AD30E17DC5EEA7418133A541BCDDF07
                                                                                                                                                                                                                            SHA-256:5ECD0274DC220312824BB3086B3E129E38A9DCB06913A2F6173A94DC256BF4C5
                                                                                                                                                                                                                            SHA-512:F8C4E0C82A8229B3BDB897B536EE73B5D2A9A2810B73DCC77C880961A9A16E43746234A108A9A15BF18638FCFB3086E0F5EEFD85D5BF6F799718DC6F199C4A26
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(U.wF..wF..wF......wF...G..wF...C..wF...B..wF...E..wF.D.G..wF...G..wF...G..wF..wG..wF.D.O..wF.D.F..wF.D.D..wF.Rich.wF.................PE..d......g.........." .....,...,.......(....................................................`......................................... Q..T...tQ..........d....p.......................G..T...........................0H..8............@...............................text....*.......,.................. ..`.rdata.......@.......0..............@..@.data...(....`.......L..............@....pdata.......p.......R..............@..@.rsrc...d............V..............@..@.reloc...............Z..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\gh99bdov

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):4
                                                                                                                                                                                                                            Entropy (8bit):2.0
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:qn:qn
                                                                                                                                                                                                                            MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                            SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                            SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                            SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:blat

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p\gen_py\__init__.py

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):176
                                                                                                                                                                                                                            Entropy (8bit):4.713840781302666
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                                                                                            MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                                                                                            SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                                                                                            SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                                                                                            SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\tmpqxtmfx2p\gen_py\dicts.dat

                                                                                                                                                                                                                            Download File
                                                                                                                                                                                                                            Process:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            File Type:data
                                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                                            Size (bytes):10
                                                                                                                                                                                                                            Entropy (8bit):2.7219280948873625
                                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                                            SSDEEP:3:qW6:qW6
                                                                                                                                                                                                                            MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                                                                                            SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                                                                                            SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                                                                                            SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                                            Preview:..K....}..

                                                                                                                                                                                                                            Static File Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            File type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                            Entropy (8bit):7.9967380377698465
                                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                                            • Win64 Executable (generic) (12005/4) 74.95%
                                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 12.51%
                                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 12.50%
                                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
                                                                                                                                                                                                                            File name:winws1.exe
                                                                                                                                                                                                                            File size:11'878'277 bytes
                                                                                                                                                                                                                            MD5:37e06d6e36e5f993a465b266ade15ea2
                                                                                                                                                                                                                            SHA1:e05d11786a37ec01145209156efc92e4ebf1ea38
                                                                                                                                                                                                                            SHA256:74ee005a858f35d69b9f32921ccf1039babc70e3a70872b5fd38edeadc0069c4
                                                                                                                                                                                                                            SHA512:4152d1c58af81504b0b5d6a5b9327077f2ee8161aaace6a6ab415946f6df4dd2e4db4300ee5d266e413a5694b10c259bc5a52d2134ad62c98a9c96da4c738f21
                                                                                                                                                                                                                            SSDEEP:196608:EV1Z2azjvj8p5drY+zg+oqiJFdQmR5dA6leJuErSEEJwlCfFshhnPM9ks8nYIi:EVlj87dtFDMdQ2li+9JUJhhbYIi
                                                                                                                                                                                                                            TLSH:0CC6337692A378D5C11F41B0C19AC6A078A4FE7413F1743C07E90BBA6F9BAB46F7A441
                                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...A.Tg.J.............(.....<... .............@....................................D.....`................................

                                                                                                                                                                                                                            File Icon

                                                                                                                                                                                                                            Icon Hash:4a464cd47461e179

                                                                                                                                                                                                                            Static PE Info

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Entrypoint:0x1400010f6
                                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                                            Imagebase:0x140000000
                                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
                                                                                                                                                                                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
                                                                                                                                                                                                                            Time Stamp:0x6754DC41 [Sat Dec 7 23:37:37 2024 UTC]
                                                                                                                                                                                                                            TLS Callbacks:0x4000dab0, 0x1, 0x4000db70, 0x1
                                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                                            OS Version Major:4
                                                                                                                                                                                                                            OS Version Minor:0
                                                                                                                                                                                                                            File Version Major:4
                                                                                                                                                                                                                            File Version Minor:0
                                                                                                                                                                                                                            Subsystem Version Major:4
                                                                                                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                                                                                                            Import Hash:cf8ad0ecdb3ba4aa29003f793248ec72

                                                                                                                                                                                                                            Entrypoint Preview

                                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 30h
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], 000000FFh
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [000206F4h]
                                                                                                                                                                                                                            mov dword ptr [eax], 00000001h
                                                                                                                                                                                                                            call 00007F6EC4993872h
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                                            nop
                                                                                                                                                                                                                            nop
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-04h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            add esp, 30h
                                                                                                                                                                                                                            pop ebp
                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 30h
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], 000000FFh
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [000206C5h]
                                                                                                                                                                                                                            mov dword ptr [eax], 00000000h
                                                                                                                                                                                                                            call 00007F6EC4993843h
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], eax
                                                                                                                                                                                                                            nop
                                                                                                                                                                                                                            nop
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-04h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            add esp, 30h
                                                                                                                                                                                                                            pop ebp
                                                                                                                                                                                                                            ret
                                                                                                                                                                                                                            push ebp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov ebp, esp
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            sub esp, 70h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov dword ptr [ebp-10h], 00000000h
                                                                                                                                                                                                                            mov dword ptr [ebp-1Ch], 00000030h
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-1Ch]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [eax]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-28h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [eax+08h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov dword ptr [ebp-18h], eax
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], 00000000h
                                                                                                                                                                                                                            jmp 00007F6EC4993853h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-10h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            cmp eax, dword ptr [ebp-18h]
                                                                                                                                                                                                                            jne 00007F6EC499383Bh
                                                                                                                                                                                                                            mov dword ptr [ebp-04h], 00000001h
                                                                                                                                                                                                                            jmp 00007F6EC4993877h
                                                                                                                                                                                                                            mov ecx, 000003E8h
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [0002853Eh]
                                                                                                                                                                                                                            call eax
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [0002069Dh]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov eax, dword ptr [ebp-18h]
                                                                                                                                                                                                                            dec eax
                                                                                                                                                                                                                            mov dword ptr [ebp+00h], eax

                                                                                                                                                                                                                            Data Directories

                                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x290000x15fc.idata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x2d0000xf41c.rsrc
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x250000xf6c.pdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x3d0000x13c.reloc
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x20a600x28.rdata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x295800x4f0.idata
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                            Sections

                                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                            .text0x10000x183c80x18400616d6c6e51c5e392d4ec9a3ff55d8079False0.444164787371134data6.169519932682489IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .data0x1a0000x1500x2000121ce293810747daec3ebac9cc32327False0.189453125data1.3863555132737315IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .rdata0x1b0000x82000x820023c563a29a4a256b26cd20c230b9aa44False0.48115985576923076data6.585400510346943IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            /40x240000x40x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .pdata0x250000xf6c0x100068aa1eabf500d997f09cbe9273da2d29False0.47412109375data5.06511475769715IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .xdata0x260000xfc40x1000faa06eeea841bc050055ea29bac6cbc1False0.25390625shared library4.378695124603942IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .bss0x270000x1ed00x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .idata0x290000x15fc0x1600784cf13538071a0d21100682f50e9e8dFalse0.33203125data4.563031060063162IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .CRT0x2b0000x600x200d44f86b8c428e457de2de5ea3e40aa46False0.06640625data0.29046607431271465IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .tls0x2c0000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                            .rsrc0x2d0000xf41c0xf6004c8f6d330806f9f4616d141f80690999False0.8030678353658537data7.55489091318796IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                            .reloc0x3d0000x13c0x20008adfa9e87cba7e06bbfd839064387caFalse0.490234375data3.5698192923734458IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                            Resources

                                                                                                                                                                                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                            RT_ICON0x2d2080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.585820895522388
                                                                                                                                                                                                                            RT_ICON0x2e0b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7360108303249098
                                                                                                                                                                                                                            RT_ICON0x2e9580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.755057803468208
                                                                                                                                                                                                                            RT_ICON0x2eec00x952cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9975384937676757
                                                                                                                                                                                                                            RT_ICON0x383ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.3887966804979253
                                                                                                                                                                                                                            RT_ICON0x3a9940x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.49530956848030017
                                                                                                                                                                                                                            RT_ICON0x3ba3c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.7207446808510638
                                                                                                                                                                                                                            RT_GROUP_ICON0x3bea40x68data0.7019230769230769
                                                                                                                                                                                                                            RT_MANIFEST0x3bf0c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                            Imports

                                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                                            ADVAPI32.dllConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetTokenInformation, OpenProcessToken
                                                                                                                                                                                                                            COMCTL32.dllLoadIconMetric
                                                                                                                                                                                                                            GDI32.dllCreateFontIndirectW, DeleteObject, SelectObject
                                                                                                                                                                                                                            KERNEL32.dllCloseHandle, CreateDirectoryW, CreateProcessW, CreateSymbolicLinkW, DeleteCriticalSection, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FormatMessageW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetEnvironmentVariableW, GetExitCodeProcess, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoW, GetTempPathW, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LocalFree, MulDiv, MultiByteToWideChar, SetConsoleCtrlHandler, SetDllDirectoryW, SetEnvironmentVariableW, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, __C_specific_handler
                                                                                                                                                                                                                            msvcrt.dll___lc_codepage_func, ___mb_cur_max_func, __argc, __iob_func, __set_app_type, __setusermatherr, __wargv, __wgetmainargs, __winitenv, _amsg_exit, _cexit, _commode, _errno, _filelengthi64, _fileno, _findclose, _fileno, _fmode, _get_osfhandle, _getpid, _initterm, _lock, _onexit, _snwprintf, _stat64, _strdup, _unlock, _wcmdln, _wcsdup, _wcsdup, _wfindfirst64, _wfindnext64, _wfopen, _wfullpath, _wputenv_s, _wremove, _wrmdir, _wstat64, _wtempnam, abort, calloc, clearerr, exit, fclose, feof, ferror, fflush, fgetpos, fprintf, fputc, fputwc, fread, free, fsetpos, fwprintf, fwrite, iswctype, localeconv, malloc, mbstowcs, memcmp, memcpy, memset, perror, realloc, setlocale, signal, strcat, strchr, strcmp, strcpy, strerror, strlen, strncat, strncmp, strncpy, strtok, strtoul, vfprintf, wcscat, wcschr, wcscmp, wcscpy, wcslen, wcsncpy, wcstombs
                                                                                                                                                                                                                            USER32.dllCreateWindowExW, DestroyIcon, DialogBoxIndirectParamW, DrawTextW, EndDialog, GetClientRect, GetDC, GetDialogBaseUnits, GetWindowLongPtrW, InvalidateRect, MessageBoxA, MessageBoxW, MoveWindow, ReleaseDC, SendMessageW, SetWindowLongPtrW, SystemParametersInfoW

                                                                                                                                                                                                                            Network Behavior

                                                                                                                                                                                                                            Network Port Distribution

                                                                                                                                                                                                                            TCP Packets

                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.885458946 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.885503054 CET44349731104.26.12.205192.168.2.6
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.885664940 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.886481047 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.886493921 CET44349731104.26.12.205192.168.2.6
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.110347986 CET44349731104.26.12.205192.168.2.6
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.110985041 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.110996962 CET44349731104.26.12.205192.168.2.6
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.112437963 CET44349731104.26.12.205192.168.2.6
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.112508059 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.113152981 CET49731443192.168.2.6104.26.12.205
                                                                                                                                                                                                                            Dec 17, 2024 11:29:18.113312006 CET49731443192.168.2.6104.26.12.205

                                                                                                                                                                                                                            UDP Packets

                                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.743837118 CET5238953192.168.2.61.1.1.1
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.883126974 CET53523891.1.1.1192.168.2.6

                                                                                                                                                                                                                            DNS Queries

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.743837118 CET192.168.2.61.1.1.10x8a40Standard query (0)api.ipify.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                            DNS Answers

                                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.883126974 CET1.1.1.1192.168.2.60x8a40No error (0)api.ipify.org104.26.12.205A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.883126974 CET1.1.1.1192.168.2.60x8a40No error (0)api.ipify.org172.67.74.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                            Dec 17, 2024 11:29:16.883126974 CET1.1.1.1192.168.2.60x8a40No error (0)api.ipify.org104.26.13.205A (IP address)IN (0x0001)false

                                                                                                                                                                                                                            Statistics

                                                                                                                                                                                                                            CPU Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            Memory Usage

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            High Level Behavior Distribution

                                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                                            Behavior

                                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                                            System Behavior

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                                            Start time:05:29:10
                                                                                                                                                                                                                            Start date:17/12/2024
                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\winws1.exe"
                                                                                                                                                                                                                            Imagebase:0x7ff611300000
                                                                                                                                                                                                                            File size:11'878'277 bytes
                                                                                                                                                                                                                            MD5 hash:37E06D6E36E5F993A465B266ADE15EA2
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            General

                                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                                            Start time:05:29:13
                                                                                                                                                                                                                            Start date:17/12/2024
                                                                                                                                                                                                                            Path:C:\Users\user\Desktop\winws1.exe
                                                                                                                                                                                                                            Wow64 process (32bit):false
                                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\winws1.exe"
                                                                                                                                                                                                                            Imagebase:0x7ff611300000
                                                                                                                                                                                                                            File size:11'878'277 bytes
                                                                                                                                                                                                                            MD5 hash:37E06D6E36E5F993A465B266ADE15EA2
                                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                                            Yara matches:
                                                                                                                                                                                                                            • Rule: JoeSecurity_AntiVM_5, Description: Yara detected AntiVM_5, Source: 00000003.00000002.2265230040.000001EE75B30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                                            Disassembly

                                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                              Execution Coverage:5.9%
                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                              Signature Coverage:14.5%
                                                                                                                                                                                                                              Total number of Nodes:1169
                                                                                                                                                                                                                              Total number of Limit Nodes:13
                                                                                                                                                                                                                              execution_graph 12147 7ff61130b150 12148 7ff61130b15e 12147->12148 12149 7ff61130b17c memcpy 12148->12149 12152 7ff61130aa7a 12148->12152 12149->12152 12150 7ff61130a4f0 4 API calls 12150->12152 12151 7ff61130ac11 12152->12150 12152->12151 12366 7ff61130adb8 12367 7ff61130ac11 12366->12367 12369 7ff61130aa7a 12366->12369 12368 7ff61130a4f0 4 API calls 12368->12369 12369->12367 12369->12368 12526 7ff61130b1d0 12528 7ff61130ae40 12526->12528 12527 7ff61130a4f0 4 API calls 12527->12528 12528->12527 12529 7ff61130aeab 12528->12529 9867 7ff6113010f6 9870 7ff611301154 9867->9870 9871 7ff61130118b 9870->9871 9872 7ff6113011f1 _amsg_exit 9871->9872 9873 7ff6113011fd 9871->9873 9874 7ff611301232 9872->9874 9873->9874 9875 7ff61130120a _initterm 9873->9875 9876 7ff61130124a _initterm 9874->9876 9877 7ff611301270 9874->9877 9875->9874 9876->9877 9886 7ff61130147c 9877->9886 9879 7ff611301309 9891 7ff61130d990 9879->9891 9882 7ff611301350 exit 9883 7ff61130135d 9882->9883 9884 7ff611301117 9883->9884 9885 7ff611301367 _cexit 9883->9885 9885->9884 9887 7ff6113014a2 9886->9887 9888 7ff6113014bd 9887->9888 9889 7ff611301558 9887->9889 9890 7ff6113014dc malloc memcpy 9888->9890 9889->9879 9890->9887 9894 7ff61130d9b6 9891->9894 9892 7ff61130da38 memset 9893 7ff61130da5f 9892->9893 9897 7ff6113016d0 9893->9897 9894->9892 9965 7ff611308fe0 9897->9965 9899 7ff6113016f3 9972 7ff6113021d0 calloc 9899->9972 9903 7ff6113022c0 44 API calls 9906 7ff611303d85 9903->9906 9904 7ff611303cfa 9904->9906 9986 7ff611307e30 9904->9986 9906->9903 9907 7ff611309090 10 API calls 9906->9907 9909 7ff6113024a0 58 API calls 9906->9909 9912 7ff611304122 SetDllDirectoryW 9906->9912 9914 7ff6113040e2 SetDllDirectoryW 9906->9914 9937 7ff611302e60 10 API calls 9906->9937 9938 7ff611304292 fclose 9906->9938 9940 7ff611303e89 strcmp 9906->9940 9948 7ff611303e5e 9906->9948 9949 7ff611303ec5 strcpy 9906->9949 9953 7ff611303dd6 SetDllDirectoryW 9906->9953 9959 7ff611307060 free free free free 9906->9959 9962 7ff611303ff0 9906->9962 10025 7ff611307020 calloc 9906->10025 10029 7ff6113036c0 9906->10029 10036 7ff611307ec0 9906->10036 10041 7ff611308820 9906->10041 10053 7ff6113071c0 9906->10053 10059 7ff611308260 9906->10059 10087 7ff611303c80 9906->10087 10149 7ff611304650 9906->10149 10155 7ff611308bb0 malloc 9906->10155 9907->9906 9908 7ff611303d2c 9910 7ff611303e00 9908->9910 9911 7ff611303d38 9908->9911 9909->9906 9993 7ff611307f20 9910->9993 9913 7ff611307e30 15 API calls 9911->9913 9916 7ff611307020 12 API calls 9912->9916 9917 7ff611303d44 9913->9917 9918 7ff611307020 12 API calls 9914->9918 9916->9906 9920 7ff611303f28 9917->9920 9922 7ff611303d5e free 9917->9922 9918->9948 9919 7ff611303e08 9996 7ff6113022c0 9919->9996 9924 7ff611307f20 12 API calls 9920->9924 9928 7ff611307f20 12 API calls 9922->9928 9923 7ff611303e16 9923->9906 10017 7ff6113024a0 9923->10017 9925 7ff611303f40 9924->9925 9929 7ff6113022c0 44 API calls 9925->9929 9930 7ff611303d6f 9928->9930 9929->9906 9932 7ff611307f20 12 API calls 9930->9932 9935 7ff611303d77 9932->9935 9936 7ff6113022c0 44 API calls 9935->9936 9936->9906 9937->9906 9938->9906 9940->9906 9944 7ff611303ede 9940->9944 9941 7ff6113071c0 FreeLibrary 9941->9948 10090 7ff611303c00 9944->10090 9946 7ff611307060 free free free free 9946->9948 9948->9906 9948->9938 9948->9940 9948->9941 9948->9946 10075 7ff611306b90 9948->10075 10111 7ff611306d80 9948->10111 10139 7ff611306fa0 9948->10139 10164 7ff6113072d0 9948->10164 9949->9944 9952 7ff611303eee 9956 7ff6113071c0 FreeLibrary 9952->9956 9955 7ff611307020 12 API calls 9953->9955 9955->9906 9958 7ff611303f02 9956->9958 10099 7ff611307060 9958->10099 9959->9906 9961 7ff611301340 9961->9882 9961->9883 10108 7ff611302210 9962->10108 9968 7ff611308ffe 9965->9968 9966 7ff611309059 9966->9899 9968->9966 9969 7ff611309031 9968->9969 10170 7ff611308ec0 9968->10170 9970 7ff611309040 free 9969->9970 9970->9970 9971 7ff611309051 free 9970->9971 9971->9966 9973 7ff6113021ed 9972->9973 9974 7ff6113021e8 9972->9974 10237 7ff611302fe0 9973->10237 9974->9906 9976 7ff6113045a0 9974->9976 10245 7ff61130f020 9976->10245 9979 7ff6113045cc 9981 7ff611308ec0 13 API calls 9979->9981 9980 7ff6113045f8 9982 7ff611302f40 10 API calls 9980->9982 9984 7ff6113045dd 9981->9984 9983 7ff6113045ea 9982->9983 9983->9904 9984->9983 10247 7ff611302e60 9984->10247 9987 7ff611307e3b 9986->9987 9988 7ff611309090 10 API calls 9987->9988 9989 7ff611307e50 GetEnvironmentVariableW 9988->9989 9990 7ff611307e78 ExpandEnvironmentStringsW 9989->9990 9991 7ff611307e66 9989->9991 9992 7ff611308ec0 13 API calls 9990->9992 9991->9908 9992->9991 9994 7ff611309090 10 API calls 9993->9994 9995 7ff611307f33 SetEnvironmentVariableW free 9994->9995 9995->9919 9997 7ff6113022d0 9996->9997 10252 7ff611301af0 9997->10252 10000 7ff6113022fb 10000->9923 10001 7ff611301af0 fputc 10002 7ff61130232b 10001->10002 10002->10000 10255 7ff611301f90 10002->10255 10004 7ff61130233a 10004->10000 10283 7ff6113042f0 10004->10283 10008 7ff61130239a 10009 7ff6113023ac 10008->10009 10010 7ff611302408 10008->10010 10011 7ff6113042f0 18 API calls 10009->10011 10013 7ff6113042f0 18 API calls 10010->10013 10012 7ff6113023be strcpy 10011->10012 10012->9923 10014 7ff611302422 10013->10014 10296 7ff611304390 10014->10296 10016 7ff611302430 10016->10012 10018 7ff6113024b1 10017->10018 10019 7ff6113024d0 10017->10019 10020 7ff611302240 2 API calls 10018->10020 10019->9906 10021 7ff6113024bd 10020->10021 10339 7ff611307f60 10021->10339 10024 7ff611302e60 10 API calls 10024->10019 10026 7ff61130703d 10025->10026 10027 7ff611307038 10025->10027 10028 7ff611302fe0 11 API calls 10026->10028 10027->9948 10028->10027 10030 7ff6113036fa 10029->10030 10031 7ff6113037b9 10029->10031 10034 7ff611303779 10030->10034 10436 7ff611301d40 10030->10436 10480 7ff611303340 10030->10480 10031->9906 10034->10031 10035 7ff611302210 free 10034->10035 10035->10034 10037 7ff611309090 10 API calls 10036->10037 10038 7ff611307ed7 10037->10038 10039 7ff611309090 10 API calls 10038->10039 10040 7ff611307ee7 _wputenv_s free free 10039->10040 10040->9906 10042 7ff611308830 10041->10042 10043 7ff611309090 10 API calls 10042->10043 10044 7ff61130885e SetConsoleCtrlHandler GetStartupInfoW 10043->10044 10045 7ff6113088ce 10044->10045 10046 7ff6113088d6 _get_osfhandle 10045->10046 10047 7ff6113088f9 _fileno _get_osfhandle 10046->10047 10048 7ff61130891d _fileno _get_osfhandle GetCommandLineW CreateProcessW 10047->10048 10049 7ff6113089c8 10048->10049 10050 7ff61130898b WaitForSingleObject GetExitCodeProcess 10048->10050 10051 7ff611302f40 10 API calls 10049->10051 10050->9906 10052 7ff6113089db 10051->10052 10052->9906 10056 7ff611307293 10053->10056 10058 7ff6113071d3 10053->10058 10054 7ff611307277 10054->10056 10731 7ff611308800 FreeLibrary 10054->10731 10056->9906 10058->10054 10058->10056 10730 7ff611308800 FreeLibrary 10058->10730 10060 7ff611308276 10059->10060 10061 7ff611309090 10 API calls 10060->10061 10062 7ff6113082a2 10061->10062 10063 7ff6113082ad wcslen 10062->10063 10064 7ff6113082c6 10063->10064 10065 7ff6113082cc wcscat 10063->10065 10064->10065 10066 7ff611308320 wcscat 10064->10066 10732 7ff61130fb70 10065->10732 10066->10065 10068 7ff6113082f7 _wrmdir 10068->9906 10072 7ff61130835e 10073 7ff61130838e _findclose 10072->10073 10074 7ff6113083a0 25 API calls 10072->10074 10752 7ff61130fc50 10072->10752 10073->10068 10074->10072 10076 7ff611306bb0 10075->10076 10077 7ff611306bb8 10075->10077 10076->9948 10077->10076 10078 7ff611301b30 31 API calls 10077->10078 10079 7ff611306bd8 10078->10079 10079->10076 10080 7ff611306be4 strncpy strncpy strncpy 10079->10080 10081 7ff611304390 4 API calls 10080->10081 10082 7ff611306c39 calloc malloc malloc 10081->10082 10083 7ff611306cb2 10082->10083 10084 7ff611306d11 10082->10084 10083->10084 10085 7ff611306cb7 memcpy memcpy memcpy free 10083->10085 10086 7ff611302e60 10 API calls 10084->10086 10085->10076 10086->10076 10088 7ff6113101e0 fputc 10087->10088 10089 7ff611303ca4 10088->10089 10089->9906 10760 7ff6113062f0 10090->10760 10096 7ff611303c2f 10098 7ff611303c3b 10096->10098 10839 7ff611306880 10096->10839 10098->9952 10100 7ff611307071 10099->10100 10101 7ff6113070ac 10099->10101 10102 7ff611307082 10100->10102 10103 7ff61130707d free 10100->10103 10101->9961 10104 7ff611307093 10102->10104 10105 7ff61130708e free 10102->10105 10103->10102 10106 7ff6113070a4 free 10104->10106 10107 7ff61130709f free 10104->10107 10105->10104 10106->10101 10107->10106 10109 7ff61130221d free 10108->10109 10110 7ff611302238 10108->10110 10109->10110 10110->9961 10112 7ff61130f020 10111->10112 10113 7ff611306d96 calloc 10112->10113 10114 7ff611306f70 strncpy 10113->10114 10134 7ff611306dbf 10113->10134 10115 7ff611306ed8 strncpy 10114->10115 10116 7ff611304390 4 API calls 10115->10116 10118 7ff611306f00 strncpy 10116->10118 10119 7ff611304390 4 API calls 10118->10119 10122 7ff611306f2d 10119->10122 10120 7ff611306de0 memcpy 10121 7ff611304390 4 API calls 10120->10121 10126 7ff611306e04 strlen strlen 10121->10126 11056 7ff611304360 10122->11056 10123 7ff611306e3d strlen 10128 7ff611306eb0 10123->10128 10123->10134 10124 7ff611306e7c 10125 7ff611302e60 10 API calls 10124->10125 10129 7ff611306e90 free 10125->10129 10131 7ff611301d40 69 API calls 10126->10131 10128->10114 10130 7ff611306eb9 10128->10130 10129->9948 10133 7ff611304390 4 API calls 10130->10133 10131->10134 10132 7ff611306f38 10135 7ff611304390 4 API calls 10132->10135 10133->10115 10134->10120 10134->10123 10134->10124 10136 7ff611306f50 10134->10136 11051 7ff611302440 10134->11051 10137 7ff611306f46 10135->10137 10138 7ff611302e60 10 API calls 10136->10138 10137->10129 10138->10137 10140 7ff6113087c0 12 API calls 10139->10140 10141 7ff611306fbb 10140->10141 10142 7ff6113087c0 12 API calls 10141->10142 10143 7ff611306fce 10142->10143 10144 7ff611307008 10143->10144 10145 7ff611306fe9 10143->10145 10146 7ff611302e60 10 API calls 10144->10146 11077 7ff611307680 GetProcAddress 10145->11077 10148 7ff611306fee 10146->10148 10148->9948 10150 7ff61130465d 10149->10150 10151 7ff611309090 10 API calls 10150->10151 10152 7ff61130467e 10151->10152 10153 7ff611309090 10 API calls 10152->10153 10154 7ff61130468f _wfopen 10153->10154 10154->9906 10156 7ff611308bdf 10155->10156 10163 7ff611308c99 free 10155->10163 10158 7ff611310020 2 API calls 10156->10158 10159 7ff611308bef 10158->10159 10159->10163 11171 7ff611310110 10159->11171 10161 7ff611310020 2 API calls 10162 7ff611308bff 10161->10162 10162->10161 10162->10163 10163->9906 10165 7ff6113072f3 10164->10165 10166 7ff611302e60 10 API calls 10165->10166 10169 7ff611307343 10165->10169 10167 7ff6113073a0 10166->10167 10168 7ff6113071c0 FreeLibrary 10167->10168 10168->10169 10169->9948 10171 7ff611308f20 WideCharToMultiByte 10170->10171 10172 7ff611308ed3 10170->10172 10174 7ff611308f67 calloc 10171->10174 10175 7ff611308fc0 10171->10175 10173 7ff611308edd WideCharToMultiByte 10172->10173 10177 7ff611308fa0 10173->10177 10178 7ff611308f12 10173->10178 10174->10173 10179 7ff611308f81 10174->10179 10176 7ff611302f40 10 API calls 10175->10176 10176->10178 10181 7ff611302f40 10 API calls 10177->10181 10178->9968 10183 7ff611302f40 GetLastError 10179->10183 10181->10178 10192 7ff6113101e0 10183->10192 10187 7ff611302f9a 10209 7ff611302d90 10187->10209 10191 7ff611302fd0 10191->10178 10193 7ff61131022b 10192->10193 10194 7ff611310202 10192->10194 10196 7ff6113122d2 fputc 10193->10196 10220 7ff6113122d2 10194->10220 10197 7ff611302f8e 10196->10197 10198 7ff611308cd0 10197->10198 10199 7ff611308cdc 10198->10199 10200 7ff611308d98 GetLastError 10199->10200 10201 7ff611308cea FormatMessageW 10199->10201 10200->10201 10202 7ff611308d1c WideCharToMultiByte 10201->10202 10203 7ff611308d70 10201->10203 10204 7ff611308db0 10202->10204 10205 7ff611308d61 10202->10205 10206 7ff611302f40 7 API calls 10203->10206 10208 7ff611302f40 7 API calls 10204->10208 10205->10187 10207 7ff611308d83 10206->10207 10207->10187 10208->10205 10210 7ff6113101e0 fputc 10209->10210 10211 7ff611302db4 10210->10211 10212 7ff611302dc0 10211->10212 10213 7ff611302dd0 10212->10213 10224 7ff611309090 10213->10224 10216 7ff611302e40 MessageBoxA 10216->10191 10217 7ff611302e0c 10218 7ff611309090 8 API calls 10217->10218 10219 7ff611302e1d MessageBoxW 10218->10219 10219->10191 10223 7ff6113122f1 10220->10223 10221 7ff611312cb2 10221->10197 10222 7ff611310330 fputc 10222->10223 10223->10221 10223->10222 10225 7ff6113090e0 MultiByteToWideChar 10224->10225 10226 7ff6113090a3 10224->10226 10228 7ff611309168 10225->10228 10229 7ff611309115 calloc 10225->10229 10227 7ff6113090ad MultiByteToWideChar 10226->10227 10231 7ff611309148 10227->10231 10232 7ff611302e07 10227->10232 10230 7ff611302f40 7 API calls 10228->10230 10229->10227 10233 7ff61130912b 10229->10233 10230->10232 10234 7ff611302f40 7 API calls 10231->10234 10232->10216 10232->10217 10235 7ff611302f40 7 API calls 10233->10235 10234->10232 10236 7ff611309140 10235->10236 10236->10232 10238 7ff6113101e0 fputc 10237->10238 10239 7ff611303027 _errno 10238->10239 10240 7ff611303034 10239->10240 10241 7ff611302d90 fputc 10240->10241 10242 7ff611303055 10241->10242 10243 7ff611302dc0 10 API calls 10242->10243 10244 7ff61130306a 10243->10244 10244->9974 10246 7ff6113045ac GetModuleFileNameW 10245->10246 10246->9979 10246->9980 10248 7ff6113101e0 fputc 10247->10248 10249 7ff611302ea2 10248->10249 10250 7ff611302dc0 10 API calls 10249->10250 10251 7ff611302eb7 10250->10251 10251->9983 10253 7ff6113101e0 fputc 10252->10253 10254 7ff611301b0d 10253->10254 10254->10000 10254->10001 10256 7ff611304650 11 API calls 10255->10256 10257 7ff611301faa 10256->10257 10258 7ff611308bb0 5 API calls 10257->10258 10280 7ff61130218c 10257->10280 10259 7ff611301fe3 10258->10259 10260 7ff611301feb 10259->10260 10306 7ff611310020 10259->10306 10262 7ff611301ff0 fclose 10260->10262 10261 7ff611302fe0 11 API calls 10264 7ff6113021ae 10261->10264 10262->10004 10264->10264 10266 7ff611302140 10268 7ff611302fe0 11 API calls 10266->10268 10267 7ff61130201d fread 10269 7ff611302153 10267->10269 10270 7ff61130203d 10267->10270 10268->10269 10272 7ff611302fe0 11 API calls 10269->10272 10271 7ff611310020 2 API calls 10270->10271 10274 7ff611302086 malloc 10271->10274 10273 7ff611302173 10272->10273 10278 7ff611302e60 10 API calls 10273->10278 10275 7ff6113020a2 fread 10274->10275 10274->10280 10276 7ff611302120 10275->10276 10277 7ff6113020b8 10275->10277 10279 7ff611302fe0 11 API calls 10276->10279 10277->10273 10282 7ff6113020d6 10277->10282 10278->10280 10281 7ff611302133 10279->10281 10280->10261 10281->10266 10282->10262 10284 7ff6113042fc 10283->10284 10315 7ff6113042c0 10284->10315 10286 7ff61130238b 10291 7ff611302240 strlen 10286->10291 10290 7ff6113042c0 fputc 10290->10286 10292 7ff611302270 10291->10292 10293 7ff611302268 10291->10293 10292->10293 10294 7ff611302281 strncmp 10292->10294 10293->10008 10294->10292 10295 7ff611302297 10294->10295 10295->10008 10297 7ff6113042c0 fputc 10296->10297 10298 7ff6113043b1 10297->10298 10299 7ff611304428 10298->10299 10300 7ff6113043d2 strlen 10298->10300 10299->10016 10300->10299 10301 7ff6113043e7 10300->10301 10302 7ff611304410 10301->10302 10303 7ff6113043f7 strncat 10301->10303 10305 7ff611304415 strlen 10302->10305 10304 7ff6113043fc 10303->10304 10304->10016 10305->10304 10309 7ff611310060 10306->10309 10310 7ff6113100a6 10309->10310 10314 7ff61131007a 10309->10314 10311 7ff6113100e8 _errno 10310->10311 10310->10314 10313 7ff611302015 10311->10313 10312 7ff6113100fa fsetpos 10312->10313 10313->10266 10313->10267 10314->10312 10314->10313 10316 7ff6113101e0 fputc 10315->10316 10317 7ff6113042e4 10316->10317 10317->10286 10318 7ff61130f3b0 10317->10318 10319 7ff61130f3ce 10318->10319 10320 7ff61130f3e9 setlocale 10319->10320 10321 7ff61130f3d9 _strdup 10319->10321 10322 7ff61130f408 10320->10322 10323 7ff61130f824 wcstombs realloc wcstombs setlocale free 10320->10323 10321->10320 10322->10323 10324 7ff61130f417 mbstowcs 10322->10324 10325 7ff611304332 10323->10325 10326 7ff61130f020 10324->10326 10325->10290 10327 7ff61130f45f mbstowcs 10326->10327 10328 7ff61130f4ad 10327->10328 10329 7ff61130f514 10327->10329 10328->10329 10331 7ff61130f4ee setlocale free 10328->10331 10330 7ff61130f81a 10329->10330 10332 7ff61130f544 10329->10332 10330->10323 10331->10325 10333 7ff61130f5c3 wcstombs realloc wcstombs 10332->10333 10336 7ff61130f5c8 wcstombs 10332->10336 10335 7ff61130f7f7 setlocale free 10333->10335 10335->10325 10336->10335 10338 7ff61130f74e 10336->10338 10338->10335 10340 7ff611307f76 10339->10340 10341 7ff611308150 10340->10341 10342 7ff611307e30 15 API calls 10340->10342 10343 7ff61130809e GetTempPathW _getpid 10341->10343 10344 7ff611307f94 10342->10344 10389 7ff611307d00 10343->10389 10346 7ff611309090 10 API calls 10344->10346 10348 7ff611307fa4 10346->10348 10350 7ff611307fb0 ExpandEnvironmentStringsW free 10348->10350 10351 7ff611308210 10348->10351 10349 7ff6113080d4 _wtempnam 10392 7ff611309210 10349->10392 10354 7ff6113081e0 10350->10354 10355 7ff611307fd9 10350->10355 10353 7ff611302e60 10 API calls 10351->10353 10367 7ff6113024cc 10353->10367 10357 7ff611302e60 10 API calls 10354->10357 10406 7ff611309420 wcslen 10355->10406 10357->10367 10359 7ff611308168 10361 7ff611308ec0 13 API calls 10359->10361 10360 7ff6113080ec free 10360->10349 10363 7ff6113080f9 10360->10363 10364 7ff611308179 free 10361->10364 10362 7ff611307fe1 10365 7ff611308138 _wcsdup 10362->10365 10366 7ff611307fe9 _wfullpath 10362->10366 10363->10367 10370 7ff6113081b0 10363->10370 10371 7ff611308107 10363->10371 10364->10367 10368 7ff611308186 10364->10368 10365->10341 10369 7ff611308221 10366->10369 10385 7ff611308006 10366->10385 10367->10019 10367->10024 10374 7ff61130818f 10368->10374 10375 7ff611308232 10368->10375 10376 7ff611302e60 10 API calls 10369->10376 10372 7ff611309090 10 API calls 10370->10372 10373 7ff611307ec0 13 API calls 10371->10373 10377 7ff6113081c1 SetEnvironmentVariableW free 10372->10377 10378 7ff611308116 free 10373->10378 10379 7ff611307ec0 13 API calls 10374->10379 10380 7ff611309090 10 API calls 10375->10380 10376->10367 10377->10367 10378->10367 10383 7ff61130819e free 10379->10383 10381 7ff611308243 SetEnvironmentVariableW free 10380->10381 10381->10367 10382 7ff611308075 CreateDirectoryW _wputenv_s free 10382->10343 10384 7ff6113081f8 10382->10384 10383->10367 10386 7ff611302e60 10 API calls 10384->10386 10385->10382 10387 7ff611308058 CreateDirectoryW wcschr 10385->10387 10388 7ff611308204 10386->10388 10387->10382 10387->10385 10388->10367 10408 7ff611310280 10389->10408 10393 7ff61130f020 10392->10393 10394 7ff611309222 GetCurrentProcess OpenProcessToken 10393->10394 10395 7ff611309266 10394->10395 10396 7ff611309310 GetTokenInformation 10394->10396 10399 7ff61130926d free 10395->10399 10397 7ff611309346 calloc 10396->10397 10398 7ff611309337 GetLastError 10396->10398 10397->10395 10400 7ff611309368 GetTokenInformation 10397->10400 10398->10395 10398->10397 10401 7ff611309286 _snwprintf LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 10399->10401 10402 7ff611309280 CloseHandle 10399->10402 10400->10399 10405 7ff611309387 ConvertSidToStringSidW 10400->10405 10403 7ff6113080e8 10401->10403 10404 7ff6113092e5 CreateDirectoryW 10401->10404 10402->10401 10403->10359 10403->10360 10404->10403 10405->10399 10407 7ff61130943b 10406->10407 10407->10362 10409 7ff6113102cb 10408->10409 10410 7ff6113102a2 10408->10410 10412 7ff611314dd3 4 API calls 10409->10412 10414 7ff611314dd3 _errno 10410->10414 10413 7ff611307d24 10412->10413 10413->10349 10419 7ff611314e50 10414->10419 10415 7ff61131583f 10416 7ff611315878 10415->10416 10420 7ff611313048 10415->10420 10416->10413 10418 7ff611313048 fputwc fwprintf fwprintf 10418->10419 10419->10415 10419->10418 10421 7ff611313066 10420->10421 10422 7ff6113130a4 10421->10422 10427 7ff611313179 10421->10427 10423 7ff6113130c0 fwprintf 10422->10423 10424 7ff6113130f5 fwprintf 10422->10424 10426 7ff61131312a 10422->10426 10423->10426 10424->10426 10425 7ff611313226 10425->10426 10431 7ff611312cc0 fputwc 10425->10431 10426->10416 10428 7ff6113131e8 10427->10428 10432 7ff611312cc0 10427->10432 10428->10425 10430 7ff611312cc0 fputwc 10428->10430 10430->10428 10431->10425 10433 7ff611312cdf 10432->10433 10434 7ff611312d17 10433->10434 10435 7ff611312d01 fputwc 10433->10435 10434->10427 10435->10434 10437 7ff611301f40 10436->10437 10438 7ff611301d5f 10436->10438 10439 7ff611302e60 10 API calls 10437->10439 10440 7ff611301e60 10438->10440 10441 7ff611301d69 10438->10441 10442 7ff611301e6b 10439->10442 10574 7ff611301ca0 10440->10574 10529 7ff611308590 10441->10529 10442->10030 10446 7ff611301e65 10446->10442 10450 7ff611302e60 10 API calls 10446->10450 10447 7ff611301d88 10451 7ff611304650 11 API calls 10447->10451 10448 7ff611301f56 10449 7ff611302fe0 11 API calls 10448->10449 10449->10442 10450->10442 10452 7ff611301d98 10451->10452 10453 7ff611301da4 10452->10453 10454 7ff611301ed0 10452->10454 10456 7ff611310020 2 API calls 10453->10456 10455 7ff611302e60 10 API calls 10454->10455 10458 7ff611301ee4 10455->10458 10457 7ff611301db4 10456->10457 10459 7ff611301f20 10457->10459 10460 7ff611301dbc 10457->10460 10461 7ff611301e9b fclose 10458->10461 10462 7ff611302fe0 11 API calls 10459->10462 10463 7ff611301e80 10460->10463 10464 7ff611301dc6 malloc 10460->10464 10461->10030 10465 7ff611301e91 10462->10465 10551 7ff611301710 10463->10551 10467 7ff611301f6e 10464->10467 10468 7ff611301ddc 10464->10468 10469 7ff611301e93 fclose 10465->10469 10471 7ff611302fe0 11 API calls 10467->10471 10470 7ff611301e16 fread 10468->10470 10478 7ff611301de4 free 10468->10478 10469->10461 10472 7ff611301df0 fwrite 10470->10472 10473 7ff611301e3b 10470->10473 10474 7ff611301f84 10471->10474 10472->10468 10475 7ff611301f00 10472->10475 10476 7ff611302fe0 11 API calls 10473->10476 10474->10465 10479 7ff611302fe0 11 API calls 10475->10479 10476->10478 10478->10469 10479->10478 10481 7ff611303354 10480->10481 10684 7ff6113032d0 10481->10684 10484 7ff611303521 10484->10030 10485 7ff6113042f0 18 API calls 10486 7ff6113033a8 10485->10486 10487 7ff6113042f0 18 API calls 10486->10487 10488 7ff6113033b3 10487->10488 10489 7ff611302240 2 API calls 10488->10489 10490 7ff6113033c2 10489->10490 10491 7ff611303530 10490->10491 10492 7ff6113033cb 10490->10492 10494 7ff611303270 6 API calls 10491->10494 10689 7ff611303270 10492->10689 10521 7ff611303450 10494->10521 10496 7ff61130340a 10498 7ff611303270 6 API calls 10496->10498 10497 7ff6113034f8 10694 7ff6113086b0 10497->10694 10500 7ff61130342f 10498->10500 10504 7ff611303270 6 API calls 10500->10504 10500->10521 10502 7ff6113021d0 12 API calls 10502->10521 10503 7ff6113034de 10503->10030 10504->10521 10505 7ff611302e60 10 API calls 10505->10484 10506 7ff611303674 10508 7ff611302e60 10 API calls 10506->10508 10507 7ff611303483 strcmp 10514 7ff611303493 10507->10514 10507->10521 10508->10484 10509 7ff611303270 6 API calls 10509->10521 10510 7ff61130349d 10510->10503 10515 7ff611302e60 10 API calls 10510->10515 10511 7ff6113034ba strcmp 10512 7ff6113034d0 10511->10512 10511->10514 10516 7ff611301d40 69 API calls 10512->10516 10513 7ff611303660 10518 7ff611302e60 10 API calls 10513->10518 10514->10510 10514->10511 10515->10484 10516->10510 10517 7ff611303645 10519 7ff611302e60 10 API calls 10517->10519 10520 7ff61130366c 10518->10520 10519->10484 10522 7ff611302210 free 10520->10522 10521->10502 10521->10506 10521->10507 10521->10509 10521->10513 10521->10517 10523 7ff611303240 fputc 10521->10523 10524 7ff611301f90 21 API calls 10521->10524 10525 7ff6113036a4 10521->10525 10522->10506 10523->10521 10524->10521 10526 7ff611302e60 10 API calls 10525->10526 10527 7ff6113036b3 10526->10527 10528 7ff611302210 free 10527->10528 10528->10506 10530 7ff61130859e 10529->10530 10585 7ff611307d30 10530->10585 10533 7ff611301d7c 10533->10447 10533->10448 10536 7ff611308610 10538 7ff61130861b 10536->10538 10541 7ff611307e30 15 API calls 10536->10541 10537 7ff6113085e4 10594 7ff611308480 10537->10594 10540 7ff611308680 10538->10540 10546 7ff61130861f 10538->10546 10542 7ff611302ed0 10 API calls 10540->10542 10547 7ff611308654 10541->10547 10542->10533 10544 7ff611304650 11 API calls 10544->10533 10608 7ff611302ed0 10546->10608 10547->10546 10549 7ff611308668 free 10547->10549 10548 7ff611308480 33 API calls 10550 7ff6113085ef 10548->10550 10549->10538 10550->10533 10550->10544 10632 7ff61130a920 10551->10632 10553 7ff611301779 10554 7ff611301783 malloc 10553->10554 10555 7ff611301a58 10553->10555 10557 7ff611301799 malloc 10554->10557 10562 7ff611301aaf 10554->10562 10556 7ff611302e60 10 API calls 10555->10556 10566 7ff61130180d 10556->10566 10559 7ff6113017af 10557->10559 10560 7ff611301a98 10557->10560 10558 7ff611302fe0 11 API calls 10558->10562 10563 7ff6113017d5 fread 10559->10563 10561 7ff611302fe0 11 API calls 10560->10561 10561->10562 10562->10558 10564 7ff6113017fd ferror 10563->10564 10569 7ff611301854 10563->10569 10564->10566 10564->10569 10566->10563 10567 7ff611301ad0 10566->10567 10566->10569 10571 7ff6113018e7 fwrite 10566->10571 10636 7ff61130a9d0 10566->10636 10568 7ff611302e60 10 API calls 10570 7ff611301892 10568->10570 10569->10568 10569->10570 10572 7ff61130189f free free 10570->10572 10571->10569 10573 7ff61130190f ferror 10571->10573 10572->10465 10573->10566 10573->10569 10575 7ff611301cae 10574->10575 10647 7ff611301b30 10575->10647 10578 7ff611301d19 free 10578->10446 10580 7ff611308480 33 API calls 10581 7ff611301cda 10580->10581 10581->10578 10582 7ff611301af0 fputc 10581->10582 10583 7ff611301d07 10582->10583 10583->10578 10672 7ff611304730 10583->10672 10586 7ff6113101e0 fputc 10585->10586 10587 7ff611307d4d 10586->10587 10587->10533 10588 7ff6113044c0 10587->10588 10589 7ff6113044cb 10588->10589 10590 7ff611309090 10 API calls 10589->10590 10591 7ff6113044e4 10590->10591 10613 7ff61130ff1b 10591->10613 10595 7ff611308490 10594->10595 10596 7ff611307d30 fputc 10595->10596 10597 7ff6113084b2 10596->10597 10598 7ff611308569 10597->10598 10599 7ff611307d30 fputc 10597->10599 10598->10550 10600 7ff6113084dc 10599->10600 10600->10598 10601 7ff6113084e7 strlen 10600->10601 10602 7ff611308504 10601->10602 10602->10598 10603 7ff611308580 10602->10603 10604 7ff611308510 strlen 10602->10604 10606 7ff6113044c0 15 API calls 10602->10606 10626 7ff6113046f0 10602->10626 10603->10550 10604->10598 10605 7ff611308526 strlen strcpy strtok 10604->10605 10605->10602 10605->10603 10606->10602 10609 7ff6113101e0 fputc 10608->10609 10610 7ff611302f12 10609->10610 10611 7ff611302dc0 10 API calls 10610->10611 10612 7ff611302f27 10611->10612 10612->10548 10620 7ff61130fd30 10613->10620 10615 7ff61130ff37 10616 7ff61130ff58 free 10615->10616 10617 7ff61130ff64 10615->10617 10616->10617 10618 7ff61130ff6a memset 10617->10618 10619 7ff6113044f1 10617->10619 10618->10619 10619->10536 10619->10537 10621 7ff61130fd4f 10620->10621 10622 7ff61130fd91 10620->10622 10621->10622 10623 7ff61130fd5f wcslen 10621->10623 10622->10615 10623->10622 10625 7ff61130fd74 10623->10625 10624 7ff61130fec6 malloc memcpy 10624->10622 10625->10622 10625->10624 10627 7ff6113046fb 10626->10627 10628 7ff611309090 10 API calls 10627->10628 10629 7ff611304714 10628->10629 10630 7ff611309210 13 API calls 10629->10630 10631 7ff61130471c 10630->10631 10631->10602 10633 7ff61130a830 10632->10633 10634 7ff61130a87e malloc 10633->10634 10635 7ff61130a893 10633->10635 10634->10635 10635->10553 10637 7ff61130aa0f 10636->10637 10639 7ff61130ac11 10637->10639 10640 7ff61130a4f0 10637->10640 10639->10566 10641 7ff61130a5b0 malloc 10640->10641 10642 7ff61130a512 10640->10642 10641->10642 10643 7ff61130a55b 10641->10643 10644 7ff61130a588 memcpy 10642->10644 10645 7ff61130a532 memcpy 10642->10645 10643->10637 10644->10643 10645->10643 10646 7ff61130a5f0 memcpy 10645->10646 10646->10643 10648 7ff611304650 11 API calls 10647->10648 10649 7ff611301b52 10648->10649 10650 7ff611301c60 10649->10650 10651 7ff611301b5e 10649->10651 10653 7ff611302e60 10 API calls 10650->10653 10652 7ff611310020 2 API calls 10651->10652 10654 7ff611301b70 10652->10654 10655 7ff611301c08 10653->10655 10656 7ff611301c40 10654->10656 10657 7ff611301b78 malloc 10654->10657 10655->10578 10655->10580 10658 7ff611302fe0 11 API calls 10656->10658 10659 7ff611301b91 10657->10659 10660 7ff611301c76 10657->10660 10663 7ff611301ba5 10658->10663 10661 7ff611301c20 10659->10661 10668 7ff611301b9d 10659->10668 10662 7ff611302fe0 11 API calls 10660->10662 10665 7ff611301710 24 API calls 10661->10665 10662->10663 10667 7ff611301c00 fclose 10663->10667 10664 7ff611301bb8 fread 10664->10668 10669 7ff611301bdd 10664->10669 10666 7ff611301c31 10665->10666 10666->10667 10671 7ff611301bf5 free 10666->10671 10667->10655 10668->10663 10668->10664 10668->10667 10670 7ff611302fe0 11 API calls 10669->10670 10670->10671 10671->10663 10673 7ff61130473e 10672->10673 10674 7ff611309090 10 API calls 10673->10674 10675 7ff61130475d 10674->10675 10676 7ff6113047d0 10675->10676 10677 7ff611309090 10 API calls 10675->10677 10676->10578 10678 7ff61130477b 10677->10678 10678->10676 10679 7ff611304780 CreateSymbolicLinkW 10678->10679 10679->10676 10680 7ff6113047a6 10679->10680 10680->10676 10681 7ff6113047b0 GetLastError 10680->10681 10681->10676 10682 7ff6113047bb 10681->10682 10683 7ff611304730 10 API calls 10682->10683 10683->10676 10714 7ff611303240 10684->10714 10686 7ff6113032f0 10687 7ff61130331d 10686->10687 10688 7ff611303309 strcpy 10686->10688 10687->10484 10687->10485 10688->10687 10690 7ff6113101e0 fputc 10689->10690 10691 7ff6113032a2 10690->10691 10692 7ff6113032b6 10691->10692 10717 7ff61130fa6a 10691->10717 10692->10496 10692->10497 10695 7ff6113086bd 10694->10695 10696 7ff611304650 11 API calls 10695->10696 10697 7ff6113086d2 10696->10697 10698 7ff611308590 40 API calls 10697->10698 10700 7ff6113086e0 10698->10700 10699 7ff6113087a9 10702 7ff61130350a 10699->10702 10703 7ff6113087ae fclose 10699->10703 10700->10699 10701 7ff61130879c 10700->10701 10705 7ff6113086f5 10700->10705 10701->10699 10704 7ff6113087a1 fclose 10701->10704 10702->10503 10702->10505 10703->10702 10704->10699 10706 7ff611308771 fclose fclose 10705->10706 10707 7ff611308710 fread 10705->10707 10706->10702 10709 7ff611308748 fwrite 10707->10709 10710 7ff61130872e ferror 10707->10710 10712 7ff611308769 clearerr 10709->10712 10713 7ff61130875d ferror 10709->10713 10710->10705 10711 7ff61130873a clearerr 10710->10711 10711->10706 10712->10706 10713->10705 10713->10712 10715 7ff6113101e0 fputc 10714->10715 10716 7ff61130325d 10715->10716 10716->10686 10724 7ff61130f8b0 10717->10724 10719 7ff61130fa86 10720 7ff61130faa7 free 10719->10720 10721 7ff61130fab3 10719->10721 10720->10721 10722 7ff61130fab9 memset 10721->10722 10723 7ff61130fada 10721->10723 10722->10723 10723->10692 10725 7ff61130f8cf 10724->10725 10729 7ff61130f90e 10724->10729 10726 7ff61130f8de strlen 10725->10726 10725->10729 10727 7ff61130f8f3 10726->10727 10726->10729 10728 7ff61130fa20 malloc memcpy 10727->10728 10727->10729 10728->10729 10729->10719 10730->10054 10731->10056 10733 7ff61130fba1 10732->10733 10734 7ff61130fbb2 memset 10733->10734 10735 7ff61130fbd5 memcpy 10733->10735 10736 7ff6113082ee 10734->10736 10735->10736 10736->10068 10737 7ff6113083a0 10736->10737 10738 7ff6113083ae 10737->10738 10739 7ff6113083e0 wcscmp 10738->10739 10751 7ff6113083d1 10738->10751 10740 7ff6113083f3 wcscat 10739->10740 10739->10751 10741 7ff61130840d 10740->10741 10742 7ff611308440 _wremove 10740->10742 10757 7ff6113093b0 FindFirstFileExW 10741->10757 10744 7ff61130844d Sleep _wremove 10742->10744 10742->10751 10744->10751 10746 7ff611308416 10748 7ff611308ec0 13 API calls 10746->10748 10747 7ff611308468 _wrmdir 10747->10751 10749 7ff61130842c 10748->10749 10750 7ff611308260 24 API calls 10749->10750 10750->10751 10751->10072 10753 7ff61130fc81 10752->10753 10754 7ff61130fc90 memset 10753->10754 10755 7ff61130fcb1 memcpy 10753->10755 10756 7ff61130fd21 10754->10756 10755->10756 10756->10072 10758 7ff611308412 10757->10758 10759 7ff6113093e4 FindClose 10757->10759 10758->10746 10758->10747 10759->10758 10761 7ff6113062fe 10760->10761 10843 7ff6113062c0 10761->10843 10764 7ff611306330 10768 7ff611304390 4 API calls 10764->10768 10784 7ff61130633f 10764->10784 10765 7ff611306407 10766 7ff611302e60 10 API calls 10765->10766 10785 7ff611303c0d 10766->10785 10767 7ff611304390 4 API calls 10769 7ff611306354 10767->10769 10770 7ff6113063a9 10768->10770 10771 7ff611302e60 10 API calls 10769->10771 10775 7ff611306359 10769->10775 10773 7ff611302e60 10 API calls 10770->10773 10777 7ff6113063ae 10770->10777 10771->10775 10773->10777 10774 7ff6113044c0 15 API calls 10778 7ff6113063b6 10774->10778 10846 7ff6113087c0 10775->10846 10776 7ff611306361 10779 7ff61130636d 10776->10779 10780 7ff611306429 10776->10780 10777->10774 10781 7ff6113087c0 12 API calls 10778->10781 10778->10784 10849 7ff6113059c0 GetProcAddress 10779->10849 10783 7ff611302f40 10 API calls 10780->10783 10781->10784 10783->10785 10784->10767 10785->10098 10786 7ff611306450 10785->10786 10982 7ff6113049f0 calloc 10786->10982 10789 7ff611306612 10791 7ff611302e60 10 API calls 10789->10791 10790 7ff61130646c 10792 7ff6113065c2 10790->10792 10793 7ff61130647c 10790->10793 10795 7ff61130653d 10791->10795 10794 7ff611302e60 10 API calls 10792->10794 10796 7ff61130662e 10793->10796 10797 7ff61130648d 10793->10797 10794->10795 11025 7ff611304960 10795->11025 10799 7ff611302e60 10 API calls 10796->10799 10997 7ff611304db0 10797->10997 10799->10795 10802 7ff6113064a4 10803 7ff6113064ac 10802->10803 10804 7ff6113065da 10802->10804 10806 7ff6113064bf 10803->10806 10807 7ff6113065e8 10803->10807 10805 7ff611302e60 10 API calls 10804->10805 10805->10795 11009 7ff611304ee0 10806->11009 10808 7ff611302e60 10 API calls 10807->10808 10808->10795 10810 7ff6113064ca 10811 7ff6113064d2 10810->10811 10812 7ff6113065f6 10810->10812 11018 7ff6113051b0 calloc 10811->11018 10814 7ff611302e60 10 API calls 10812->10814 10814->10795 10816 7ff6113064e5 10819 7ff611306620 10816->10819 10820 7ff6113064f8 10816->10820 10817 7ff611306604 10818 7ff611302e60 10 API calls 10817->10818 10818->10795 10821 7ff611302e60 10 API calls 10819->10821 10822 7ff61130656e fflush 10820->10822 10823 7ff6113064ff 10820->10823 10821->10795 10824 7ff61130657d fflush 10822->10824 10823->10795 10825 7ff611302e60 10 API calls 10823->10825 10824->10823 10825->10795 10826 7ff611306640 strlen 10827 7ff61130667d 10826->10827 10828 7ff611306799 10827->10828 10829 7ff611306689 10827->10829 10830 7ff611302e60 10 API calls 10828->10830 10832 7ff611306788 10829->10832 10833 7ff611301b30 31 API calls 10829->10833 10834 7ff611306733 10829->10834 10837 7ff6113066db free 10829->10837 10831 7ff611306770 10830->10831 10831->10096 10832->10096 10833->10829 10835 7ff611302e60 10 API calls 10834->10835 10838 7ff611306742 free 10835->10838 10837->10829 10838->10831 10840 7ff611306893 10839->10840 10842 7ff611306898 10839->10842 10840->10098 10842->10840 11043 7ff6113067b0 strlen 10842->11043 10844 7ff6113101e0 fputc 10843->10844 10845 7ff6113062e4 10844->10845 10845->10764 10845->10765 10847 7ff611309090 10 API calls 10846->10847 10848 7ff6113087d3 LoadLibraryExW free 10847->10848 10848->10776 10850 7ff6113059e9 GetProcAddress 10849->10850 10851 7ff611305ea6 10849->10851 10853 7ff611305a05 GetProcAddress 10850->10853 10854 7ff611305edc 10850->10854 10852 7ff611302f40 10 API calls 10851->10852 10979 7ff611305e9d 10852->10979 10855 7ff611305a21 GetProcAddress 10853->10855 10856 7ff611305ec7 10853->10856 10857 7ff611302f40 10 API calls 10854->10857 10859 7ff611305a3d GetProcAddress 10855->10859 10860 7ff611305f06 10855->10860 10858 7ff611302f40 10 API calls 10856->10858 10857->10979 10858->10979 10861 7ff611305ef1 10859->10861 10862 7ff611305a59 GetProcAddress 10859->10862 10863 7ff611302f40 10 API calls 10860->10863 10866 7ff611302f40 10 API calls 10861->10866 10864 7ff611305a75 GetProcAddress 10862->10864 10865 7ff611305f48 10862->10865 10863->10979 10868 7ff611305a91 GetProcAddress 10864->10868 10869 7ff611305f30 10864->10869 10867 7ff611302f40 10 API calls 10865->10867 10866->10979 10867->10979 10871 7ff611305aad GetProcAddress 10868->10871 10872 7ff611305f1b 10868->10872 10870 7ff611302f40 10 API calls 10869->10870 10870->10979 10874 7ff611305f60 10871->10874 10875 7ff611305ac9 GetProcAddress 10871->10875 10873 7ff611302f40 10 API calls 10872->10873 10873->10979 10876 7ff611302f40 10 API calls 10874->10876 10877 7ff611305ae5 GetProcAddress 10875->10877 10878 7ff611305fc0 10875->10878 10876->10979 10880 7ff611305b01 GetProcAddress 10877->10880 10881 7ff611305fa8 10877->10881 10879 7ff611302f40 10 API calls 10878->10879 10879->10979 10883 7ff611305f90 10880->10883 10884 7ff611305b1d GetProcAddress 10880->10884 10882 7ff611302f40 10 API calls 10881->10882 10882->10979 10887 7ff611302f40 10 API calls 10883->10887 10885 7ff611305b39 GetProcAddress 10884->10885 10886 7ff611305f78 10884->10886 10889 7ff611305b55 GetProcAddress 10885->10889 10890 7ff611306020 10885->10890 10888 7ff611302f40 10 API calls 10886->10888 10887->10979 10888->10979 10891 7ff611305b71 GetProcAddress 10889->10891 10892 7ff611306008 10889->10892 10893 7ff611302f40 10 API calls 10890->10893 10894 7ff611305ff0 10891->10894 10895 7ff611305b8d GetProcAddress 10891->10895 10896 7ff611302f40 10 API calls 10892->10896 10893->10979 10899 7ff611302f40 10 API calls 10894->10899 10897 7ff611305ba9 GetProcAddress 10895->10897 10898 7ff611305fd8 10895->10898 10896->10979 10900 7ff611305bc5 GetProcAddress 10897->10900 10901 7ff611306038 10897->10901 10902 7ff611302f40 10 API calls 10898->10902 10899->10979 10903 7ff611305be1 GetProcAddress 10900->10903 10904 7ff611306050 10900->10904 10905 7ff611302f40 10 API calls 10901->10905 10902->10979 10906 7ff611306080 10903->10906 10907 7ff611305bfd GetProcAddress 10903->10907 10908 7ff611302f40 10 API calls 10904->10908 10905->10979 10911 7ff611302f40 10 API calls 10906->10911 10909 7ff611305c19 GetProcAddress 10907->10909 10910 7ff611306068 10907->10910 10908->10979 10912 7ff611305c35 GetProcAddress 10909->10912 10913 7ff6113060c8 10909->10913 10914 7ff611302f40 10 API calls 10910->10914 10911->10979 10916 7ff611305c51 GetProcAddress 10912->10916 10917 7ff6113060b0 10912->10917 10915 7ff611302f40 10 API calls 10913->10915 10914->10979 10915->10979 10919 7ff611305c6d GetProcAddress 10916->10919 10920 7ff611306098 10916->10920 10918 7ff611302f40 10 API calls 10917->10918 10918->10979 10922 7ff6113060e0 10919->10922 10923 7ff611305c89 GetProcAddress 10919->10923 10921 7ff611302f40 10 API calls 10920->10921 10921->10979 10924 7ff611302f40 10 API calls 10922->10924 10925 7ff611305ca5 GetProcAddress 10923->10925 10926 7ff611306140 10923->10926 10924->10979 10928 7ff611305cc1 GetProcAddress 10925->10928 10929 7ff611306128 10925->10929 10927 7ff611302f40 10 API calls 10926->10927 10927->10979 10931 7ff611306110 10928->10931 10932 7ff611305cdd GetProcAddress 10928->10932 10930 7ff611302f40 10 API calls 10929->10930 10930->10979 10935 7ff611302f40 10 API calls 10931->10935 10933 7ff611305cf9 GetProcAddress 10932->10933 10934 7ff6113060f8 10932->10934 10937 7ff611305d15 GetProcAddress 10933->10937 10938 7ff6113061a0 10933->10938 10936 7ff611302f40 10 API calls 10934->10936 10935->10979 10936->10979 10939 7ff611305d31 GetProcAddress 10937->10939 10940 7ff611306188 10937->10940 10941 7ff611302f40 10 API calls 10938->10941 10942 7ff611306170 10939->10942 10943 7ff611305d4d GetProcAddress 10939->10943 10944 7ff611302f40 10 API calls 10940->10944 10941->10979 10947 7ff611302f40 10 API calls 10942->10947 10945 7ff611305d69 GetProcAddress 10943->10945 10946 7ff611306158 10943->10946 10944->10979 10948 7ff611305d85 GetProcAddress 10945->10948 10949 7ff6113061d0 10945->10949 10950 7ff611302f40 10 API calls 10946->10950 10947->10979 10951 7ff611305da1 GetProcAddress 10948->10951 10952 7ff6113061b8 10948->10952 10953 7ff611302f40 10 API calls 10949->10953 10950->10979 10955 7ff611306200 10951->10955 10956 7ff611305dbd GetProcAddress 10951->10956 10954 7ff611302f40 10 API calls 10952->10954 10953->10979 10954->10979 10959 7ff611302f40 10 API calls 10955->10959 10957 7ff611305dd9 GetProcAddress 10956->10957 10958 7ff6113061e8 10956->10958 10960 7ff611305df5 GetProcAddress 10957->10960 10961 7ff611306260 10957->10961 10962 7ff611302f40 10 API calls 10958->10962 10959->10979 10963 7ff611305e11 GetProcAddress 10960->10963 10964 7ff611306248 10960->10964 10965 7ff611302f40 10 API calls 10961->10965 10962->10979 10967 7ff611306230 10963->10967 10968 7ff611305e2d GetProcAddress 10963->10968 10966 7ff611302f40 10 API calls 10964->10966 10965->10979 10966->10979 10969 7ff611302f40 10 API calls 10967->10969 10970 7ff611305e49 GetProcAddress 10968->10970 10971 7ff611306218 10968->10971 10969->10979 10973 7ff611305e65 GetProcAddress 10970->10973 10974 7ff611306290 10970->10974 10972 7ff611302f40 10 API calls 10971->10972 10972->10979 10975 7ff611305e81 GetProcAddress 10973->10975 10976 7ff611306278 10973->10976 10977 7ff611302f40 10 API calls 10974->10977 10975->10979 10980 7ff6113062a8 10975->10980 10978 7ff611302f40 10 API calls 10976->10978 10977->10979 10978->10979 10979->10785 10981 7ff611302f40 10 API calls 10980->10981 10981->10979 10983 7ff611304c88 10982->10983 10992 7ff611304a1e 10982->10992 10983->10789 10983->10790 10984 7ff611304d00 10985 7ff611304a81 strncmp 10985->10992 10986 7ff611304aa5 strcmp 10986->10992 10987 7ff611304ad0 strcmp 10987->10992 10988 7ff611304b30 calloc calloc 10989 7ff611304c80 10988->10989 10996 7ff611304b65 10988->10996 10991 7ff611304960 4 API calls 10989->10991 10990 7ff611304af8 strcmp 10990->10992 10991->10983 10992->10984 10992->10985 10992->10986 10992->10987 10992->10988 10992->10990 11033 7ff6113047f0 strlen strncmp 10992->11033 10994 7ff611304860 mbstowcs 10994->10996 10995 7ff6113047f0 strlen strncmp 10995->10996 10996->10983 10996->10989 10996->10994 10996->10995 10998 7ff611304dc4 10997->10998 10999 7ff611304e28 10997->10999 11001 7ff611304df0 10998->11001 11002 7ff611304dc6 10998->11002 11000 7ff6113048b0 11 API calls 10999->11000 11004 7ff611304e3e 11000->11004 11003 7ff611304e18 11001->11003 11006 7ff6113048b0 11 API calls 11001->11006 11002->11003 11035 7ff6113048b0 11002->11035 11003->10802 11004->10802 11008 7ff611304e0d 11006->11008 11008->10802 11010 7ff611304ef2 11009->11010 11040 7ff611304930 11010->11040 11013 7ff611304930 fputc 11016 7ff611304f83 11013->11016 11015 7ff611309090 10 API calls 11015->11016 11016->11015 11017 7ff611304fd1 free free free 11016->11017 11017->10810 11019 7ff6113052d5 11018->11019 11021 7ff6113051e2 11018->11021 11019->10816 11019->10817 11020 7ff611309090 10 API calls 11020->11021 11021->11020 11022 7ff611305226 11021->11022 11022->11019 11023 7ff6113052cd free 11022->11023 11024 7ff6113052b8 free 11022->11024 11023->11019 11024->11023 11024->11024 11026 7ff611303c23 11025->11026 11027 7ff61130496e 11025->11027 11026->10098 11026->10826 11028 7ff611304996 free 11027->11028 11029 7ff611304980 free 11027->11029 11030 7ff6113049c6 free 11028->11030 11031 7ff6113049a6 11028->11031 11029->11028 11029->11029 11030->11026 11032 7ff6113049b0 free 11031->11032 11032->11030 11032->11032 11034 7ff61130481a 11033->11034 11034->10992 11036 7ff611309090 10 API calls 11035->11036 11037 7ff6113048ca 11036->11037 11038 7ff611304915 11037->11038 11039 7ff6113048e9 free 11037->11039 11038->10802 11039->11038 11041 7ff6113101e0 fputc 11040->11041 11042 7ff611304954 11041->11042 11042->11013 11042->11017 11044 7ff6113067e6 11043->11044 11045 7ff61130685c 11044->11045 11046 7ff611306826 11044->11046 11047 7ff611302e60 10 API calls 11045->11047 11048 7ff611306836 11046->11048 11049 7ff611302e60 10 API calls 11046->11049 11047->11048 11048->10842 11050 7ff611306850 11049->11050 11050->10842 11052 7ff61130246b strcmp 11051->11052 11053 7ff611302457 11051->11053 11054 7ff611302460 11052->11054 11055 7ff61130247b 11052->11055 11053->10134 11054->11052 11054->11053 11055->10134 11059 7ff61130f060 setlocale 11056->11059 11060 7ff61130f099 setlocale 11059->11060 11061 7ff61130f089 _strdup 11059->11061 11062 7ff61130f326 wcstombs realloc wcstombs setlocale free 11060->11062 11063 7ff61130f0b8 11060->11063 11061->11060 11065 7ff611304370 strcpy 11062->11065 11063->11062 11064 7ff61130f0c7 mbstowcs 11063->11064 11066 7ff61130f020 11064->11066 11065->10132 11067 7ff61130f10f mbstowcs 11066->11067 11068 7ff61130f14f 11067->11068 11069 7ff61130f323 11068->11069 11075 7ff61130f183 11068->11075 11069->11062 11070 7ff61130f299 wcstombs realloc wcstombs 11074 7ff61130f2fa setlocale free 11070->11074 11071 7ff61130f234 wcstombs 11072 7ff61130f256 11071->11072 11073 7ff61130f264 wcstombs 11071->11073 11072->11073 11073->11074 11076 7ff61130f28f 11073->11076 11074->11065 11075->11070 11075->11071 11076->11074 11078 7ff6113079ff 11077->11078 11079 7ff6113076ad GetProcAddress 11077->11079 11080 7ff611302f40 10 API calls 11078->11080 11081 7ff611307a34 11079->11081 11082 7ff6113076c9 GetProcAddress 11079->11082 11168 7ff6113079f5 11080->11168 11085 7ff611302f40 10 API calls 11081->11085 11083 7ff6113076e5 GetProcAddress 11082->11083 11084 7ff611307a1f 11082->11084 11086 7ff611307701 GetProcAddress 11083->11086 11087 7ff611307a5e 11083->11087 11088 7ff611302f40 10 API calls 11084->11088 11085->11168 11089 7ff61130771d GetProcAddress 11086->11089 11090 7ff611307a49 11086->11090 11091 7ff611302f40 10 API calls 11087->11091 11088->11168 11092 7ff611307aa0 11089->11092 11093 7ff611307739 GetProcAddress 11089->11093 11094 7ff611302f40 10 API calls 11090->11094 11091->11168 11097 7ff611302f40 10 API calls 11092->11097 11095 7ff611307755 GetProcAddress 11093->11095 11096 7ff611307a88 11093->11096 11094->11168 11099 7ff611307a73 11095->11099 11100 7ff611307771 GetProcAddress 11095->11100 11098 7ff611302f40 10 API calls 11096->11098 11097->11168 11098->11168 11101 7ff611302f40 10 API calls 11099->11101 11102 7ff61130778d GetProcAddress 11100->11102 11103 7ff611307ab8 11100->11103 11101->11168 11104 7ff6113077a9 GetProcAddress 11102->11104 11105 7ff611307b18 11102->11105 11106 7ff611302f40 10 API calls 11103->11106 11108 7ff6113077c5 GetProcAddress 11104->11108 11109 7ff611307b00 11104->11109 11107 7ff611302f40 10 API calls 11105->11107 11106->11168 11107->11168 11111 7ff6113077e1 GetProcAddress 11108->11111 11112 7ff611307ae8 11108->11112 11110 7ff611302f40 10 API calls 11109->11110 11110->11168 11113 7ff611307ad0 11111->11113 11114 7ff6113077fd GetProcAddress 11111->11114 11115 7ff611302f40 10 API calls 11112->11115 11116 7ff611302f40 10 API calls 11113->11116 11117 7ff611307819 GetProcAddress 11114->11117 11118 7ff611307b78 11114->11118 11115->11168 11116->11168 11120 7ff611307835 GetProcAddress 11117->11120 11121 7ff611307b60 11117->11121 11119 7ff611302f40 10 API calls 11118->11119 11119->11168 11122 7ff611307851 GetProcAddress 11120->11122 11123 7ff611307b48 11120->11123 11124 7ff611302f40 10 API calls 11121->11124 11126 7ff611307b30 11122->11126 11127 7ff61130786d GetProcAddress 11122->11127 11125 7ff611302f40 10 API calls 11123->11125 11124->11168 11125->11168 11130 7ff611302f40 10 API calls 11126->11130 11128 7ff611307b90 11127->11128 11129 7ff611307889 GetProcAddress 11127->11129 11133 7ff611302f40 10 API calls 11128->11133 11131 7ff6113078a5 GetProcAddress 11129->11131 11132 7ff611307ba8 11129->11132 11130->11168 11134 7ff6113078c1 GetProcAddress 11131->11134 11135 7ff611307bd8 11131->11135 11136 7ff611302f40 10 API calls 11132->11136 11133->11168 11137 7ff611307bc0 11134->11137 11138 7ff6113078dd GetProcAddress 11134->11138 11139 7ff611302f40 10 API calls 11135->11139 11136->11168 11142 7ff611302f40 10 API calls 11137->11142 11140 7ff611307c20 11138->11140 11141 7ff6113078f9 GetProcAddress 11138->11141 11139->11168 11145 7ff611302f40 10 API calls 11140->11145 11143 7ff611307915 GetProcAddress 11141->11143 11144 7ff611307c08 11141->11144 11142->11168 11147 7ff611307931 GetProcAddress 11143->11147 11148 7ff611307bf0 11143->11148 11146 7ff611302f40 10 API calls 11144->11146 11145->11168 11146->11168 11150 7ff61130794d GetProcAddress 11147->11150 11151 7ff611307c38 11147->11151 11149 7ff611302f40 10 API calls 11148->11149 11149->11168 11152 7ff611307969 GetProcAddress 11150->11152 11153 7ff611307c98 11150->11153 11154 7ff611302f40 10 API calls 11151->11154 11156 7ff611307985 GetProcAddress 11152->11156 11157 7ff611307c80 11152->11157 11155 7ff611302f40 10 API calls 11153->11155 11154->11168 11155->11168 11159 7ff6113079a1 GetProcAddress 11156->11159 11160 7ff611307c68 11156->11160 11158 7ff611302f40 10 API calls 11157->11158 11158->11168 11161 7ff611307c50 11159->11161 11162 7ff6113079bd GetProcAddress 11159->11162 11163 7ff611302f40 10 API calls 11160->11163 11164 7ff611302f40 10 API calls 11161->11164 11165 7ff611307cb0 11162->11165 11166 7ff6113079d9 GetProcAddress 11162->11166 11163->11168 11164->11168 11167 7ff611302f40 10 API calls 11165->11167 11166->11168 11169 7ff611307cc8 11166->11169 11167->11168 11168->10148 11170 7ff611302f40 10 API calls 11169->11170 11170->11168 11174 7ff611310130 fgetpos 11171->11174 11175 7ff611310128 11174->11175 11175->10162

                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                              Function 00007FF611307F60 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 188COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 0 7ff611307f60-7ff611307f82 call 7ff61130f020 3 7ff611308150-7ff611308160 0->3 4 7ff611307f88-7ff611307faa call 7ff611307e30 call 7ff611309090 0->4 6 7ff61130809e-7ff6113080cd GetTempPathW _getpid call 7ff611307d00 3->6 13 7ff611307fb0-7ff611307fd3 ExpandEnvironmentStringsW free 4->13 14 7ff611308210-7ff61130821c call 7ff611302e60 4->14 12 7ff6113080d4-7ff6113080e3 _wtempnam call 7ff611309210 6->12 19 7ff6113080e8-7ff6113080ea 12->19 17 7ff6113081e0-7ff6113081ec call 7ff611302e60 13->17 18 7ff611307fd9-7ff611307fe3 call 7ff611309420 13->18 27 7ff61130811e 14->27 17->27 32 7ff611308138-7ff611308141 _wcsdup 18->32 33 7ff611307fe9-7ff611308000 _wfullpath 18->33 23 7ff611308168-7ff611308184 call 7ff611308ec0 free 19->23 24 7ff6113080ec-7ff6113080f7 free 19->24 35 7ff6113081a6-7ff6113081ab 23->35 36 7ff611308186-7ff611308189 23->36 24->12 29 7ff6113080f9-7ff6113080fc 24->29 30 7ff611308120-7ff611308133 27->30 29->27 34 7ff6113080fe-7ff611308101 29->34 32->3 37 7ff611308221-7ff61130822d call 7ff611302e60 33->37 38 7ff611308006-7ff611308035 call 7ff611319300 33->38 39 7ff6113081b0-7ff6113081d7 call 7ff611309090 SetEnvironmentVariableW free 34->39 40 7ff611308107-7ff611308119 call 7ff611307ec0 free 34->40 35->30 43 7ff61130818f-7ff6113081a1 call 7ff611307ec0 free 36->43 44 7ff611308232-7ff611308259 call 7ff611309090 SetEnvironmentVariableW free 36->44 37->27 54 7ff611308075-7ff611308098 CreateDirectoryW _wputenv_s free 38->54 55 7ff611308037 38->55 39->27 40->27 43->35 44->35 54->6 58 7ff6113081f8-7ff611308204 call 7ff611302e60 54->58 57 7ff611308040-7ff611308073 call 7ff611319320 CreateDirectoryW wcschr 55->57 57->54 58->27
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$CreateDirectoryEnvironment$ByteCharExpandMultiPathStringsTempVariableWide_getpid_wcsdup_wfullpath_wputenv_s_wtempnamwcschrwcslen
                                                                                                                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 2274789544-3119237222
                                                                                                                                                                                                                              • Opcode ID: 671dda77df2ef5e6ce07f0f1f353edfb057de789b396c98f01983217660df552
                                                                                                                                                                                                                              • Instruction ID: 727f2a12e79b7da31d9e4b5a610f38af72b660992e3f0f6dfc138cee1b0007ad
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 671dda77df2ef5e6ce07f0f1f353edfb057de789b396c98f01983217660df552
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62612A21F49E5681FB59BB66A8192BA52E9AF49FE0F484431DD0ED778EED2CE405C300
                                                                                                                                                                                                                              Function 00007FF611301154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _initterm$_amsg_exit_cexitexit
                                                                                                                                                                                                                              • String ID: 0
                                                                                                                                                                                                                              • API String ID: 602970348-4108050209
                                                                                                                                                                                                                              • Opcode ID: 68b42a7169f47ea2a0c2489e8fdb899db89ccd3641b59c7d876ca4fdc4d75048
                                                                                                                                                                                                                              • Instruction ID: 32e468780db96470642340ab7d6b11e790d630cf4aa8f3085b8af854b9925a1a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68b42a7169f47ea2a0c2489e8fdb899db89ccd3641b59c7d876ca4fdc4d75048
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2619279A08F0689FB01ABA9E98436937A8BB48FA4F404435DD0DD7769DF7CE4448790
                                                                                                                                                                                                                              Function 00007FF61130AAA0 Relevance: 6.9, Strings: 5, Instructions: 602COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 585 7ff61130aaa0-7ff61130aaa3 586 7ff61130aad6-7ff61130aaf6 585->586 587 7ff61130aaa5-7ff61130aaa7 585->587 590 7ff61130c4b6-7ff61130c4d4 586->590 591 7ff61130aafc-7ff61130ab11 call 7ff611309860 586->591 588 7ff61130b8a8-7ff61130b8bc 587->588 589 7ff61130aaad-7ff61130aaaf 587->589 593 7ff61130aac0-7ff61130aad4 589->593 595 7ff61130c4de-7ff61130c4f1 590->595 599 7ff61130ab1a-7ff61130ab27 591->599 593->586 596 7ff61130aab8-7ff61130aaba 593->596 600 7ff61130c6cb-7ff61130c6e0 595->600 596->593 598 7ff61130b8c8-7ff61130b8de 596->598 599->588 601 7ff61130ab2d-7ff61130ab35 599->601 604 7ff61130c74e-7ff61130c766 600->604 602 7ff61130acd8-7ff61130acdb 601->602 603 7ff61130ab3b-7ff61130ab5d 601->603 607 7ff61130c3c6 602->607 608 7ff61130ace1-7ff61130ace3 602->608 605 7ff61130bca0-7ff61130bcbb 603->605 606 7ff61130ab63-7ff61130ab66 603->606 610 7ff61130ae40-7ff61130ae65 605->610 611 7ff61130ab98-7ff61130abb2 606->611 612 7ff61130ab68-7ff61130ab6c 606->612 609 7ff61130c3e5-7ff61130c3f7 607->609 608->609 613 7ff61130ace9-7ff61130ad10 608->613 618 7ff61130ae67-7ff61130ae6b 610->618 619 7ff61130ae90-7ff61130ae9e call 7ff61130a4f0 610->619 616 7ff61130abb8-7ff61130abbb 611->616 617 7ff61130c190-7ff61130c1a1 611->617 614 7ff61130ab6e 612->614 615 7ff61130ab80-7ff61130ab94 612->615 620 7ff61130ad16-7ff61130ad19 613->620 621 7ff61130b7a3-7ff61130b7bb 613->621 623 7ff61130b9f2-7ff61130b9fe 614->623 626 7ff61130ab96 615->626 627 7ff61130ab78-7ff61130ab7a 615->627 628 7ff61130abc1-7ff61130abc3 616->628 629 7ff61130c284-7ff61130c2a4 616->629 635 7ff61130c1e9-7ff61130c1f8 617->635 630 7ff61130aebd-7ff61130aed5 618->630 631 7ff61130ae6d-7ff61130ae77 618->631 640 7ff61130aea3-7ff61130aea5 619->640 632 7ff61130c02f-7ff61130c046 620->632 633 7ff61130ad1f-7ff61130ad22 620->633 624 7ff61130b7bd-7ff61130b7bf 621->624 625 7ff61130b7f0-7ff61130b833 621->625 623->610 624->588 643 7ff61130b7c5-7ff61130b7c7 624->643 644 7ff61130b83e-7ff61130b84c 625->644 645 7ff61130b835-7ff61130b838 625->645 626->611 627->615 634 7ff61130b9f0 627->634 628->617 636 7ff61130abc9-7ff61130abd2 628->636 638 7ff61130c2aa-7ff61130c2c9 call 7ff611309e50 629->638 639 7ff61130c4a2-7ff61130c4ac call 7ff611309860 629->639 641 7ff61130aed7-7ff61130aeda 630->641 642 7ff61130aee0-7ff61130aeff 630->642 631->630 637 7ff61130ae79-7ff61130ae7e 631->637 651 7ff61130c16b-7ff61130c16e 632->651 646 7ff61130ad28-7ff61130ad4d 633->646 647 7ff61130ac1c-7ff61130ac3f 633->647 634->623 672 7ff61130c272-7ff61130c27f 635->672 652 7ff61130abd6-7ff61130abdb 636->652 653 7ff61130abd4 636->653 637->619 654 7ff61130ae80-7ff61130ae88 637->654 697 7ff61130c2d1-7ff61130c315 638->697 639->590 657 7ff61130aeab-7ff61130aeb9 640->657 658 7ff61130bc20-7ff61130bc30 640->658 641->642 659 7ff61130b8f0-7ff61130b90f 641->659 660 7ff61130b8e8 642->660 661 7ff61130af05-7ff61130af28 642->661 662 7ff61130b7d8-7ff61130b7ec 643->662 664 7ff61130b85a-7ff61130b866 644->664 645->635 645->644 648 7ff61130ad4f-7ff61130ad51 646->648 649 7ff61130ad83-7ff61130ad93 646->649 647->604 656 7ff61130ac45-7ff61130ac50 647->656 648->588 663 7ff61130ad57-7ff61130ad59 648->663 666 7ff61130ad99-7ff61130adb0 649->666 667 7ff61130bfa0-7ff61130bfb6 649->667 668 7ff61130c3b0-7ff61130c3bc 651->668 669 7ff61130c174-7ff61130c182 651->669 652->617 673 7ff61130abe1-7ff61130abfd 652->673 653->652 654->630 674 7ff61130ae8a 654->674 684 7ff61130ac59-7ff61130ac5c 656->684 657->630 658->605 670 7ff61130b930-7ff61130b93a call 7ff611309860 659->670 671 7ff61130b911-7ff61130b916 call 7ff611309e50 659->671 660->659 677 7ff61130af2a-7ff61130af32 661->677 678 7ff61130af34-7ff61130af37 661->678 679 7ff61130b7ee 662->679 680 7ff61130b7d0-7ff61130b7d2 662->680 681 7ff61130ad68-7ff61130ad7c 663->681 683 7ff61130b86b-7ff61130b87a 664->683 685 7ff61130ae2d-7ff61130ae3f 666->685 667->600 682 7ff61130bfbc-7ff61130bfbe 667->682 668->607 669->617 699 7ff61130b91b-7ff61130b924 670->699 671->699 673->685 674->619 677->678 688 7ff61130af3d-7ff61130af58 677->688 678->688 689 7ff61130bfc5 678->689 679->625 680->598 680->662 690 7ff61130ad7e 681->690 691 7ff61130ad60-7ff61130ad62 681->691 682->689 683->672 692 7ff61130b880-7ff61130b89d 683->692 693 7ff61130bac0-7ff61130bafc 684->693 694 7ff61130ac62-7ff61130ac6b 684->694 685->610 689->632 690->649 691->598 691->681 692->588 692->684 700 7ff61130bb4c-7ff61130bb4e 693->700 701 7ff61130bafe-7ff61130bb00 693->701 694->693 698 7ff61130ac71-7ff61130acbd call 7ff611309f60 694->698 702 7ff61130c317-7ff61130c319 697->702 703 7ff61130c37f-7ff61130c39c 697->703 715 7ff61130aa7a-7ff61130aa82 698->715 716 7ff61130acc3-7ff61130accf 698->716 699->642 700->664 707 7ff61130bb54-7ff61130bb57 700->707 701->588 705 7ff61130bb06-7ff61130bb08 701->705 702->588 706 7ff61130c31f-7ff61130c32d 702->706 708 7ff61130bb70-7ff61130bb73 703->708 709 7ff61130c3a2 703->709 711 7ff61130bb18-7ff61130bb45 705->711 712 7ff61130c338-7ff61130c376 706->712 707->697 713 7ff61130bb5d-7ff61130bb6e 707->713 708->651 714 7ff61130bb79-7ff61130bb8e 708->714 709->683 717 7ff61130bb47-7ff61130bb49 711->717 718 7ff61130bb10-7ff61130bb12 711->718 719 7ff61130c378-7ff61130c37d 712->719 720 7ff61130c330-7ff61130c332 712->720 713->708 714->599 721 7ff61130aa88-7ff61130aa93 715->721 722 7ff61130ac11-7ff61130ac17 715->722 716->599 717->700 718->598 718->711 719->703 720->595 720->712 721->585 722->688
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: incorrect data check$invalid block type$invalid literal/length code$invalid stored block lengths$too many length or distance symbols
                                                                                                                                                                                                                              • API String ID: 0-817236767
                                                                                                                                                                                                                              • Opcode ID: edda78cfee263c1a0d51050989b18d83d5165dd7758e07e4666f51b0d9e6ee7b
                                                                                                                                                                                                                              • Instruction ID: 33b95c9e2ed047d787a537b61443be09714c678ab8fc6b4d304ee8bb5b743ba0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: edda78cfee263c1a0d51050989b18d83d5165dd7758e07e4666f51b0d9e6ee7b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9C32D377A18A928BD3548F25E48893E7BE9F744BA4F154235DA5AC3788DF3CE944CB00
                                                                                                                                                                                                                              Function 00007FF61130B278 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: invalid bit length repeat$invalid code -- missing end-of-block$invalid distances set$invalid literal/lengths set
                                                                                                                                                                                                                              • API String ID: 0-1153561608
                                                                                                                                                                                                                              • Opcode ID: cff788bb3bcb304cddf1bce8afa9734ec4ede5906092ff3c2facd10851e22f08
                                                                                                                                                                                                                              • Instruction ID: 9041bf5dcb0937a8eb4fdb0fb32992a5deacdd2685749f55536b79c7ca3971f7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cff788bb3bcb304cddf1bce8afa9734ec4ede5906092ff3c2facd10851e22f08
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CF1B376A18B528BD7548F14E488A3E77EDFB44B94F564139DA4AC3788DF38E944CB00
                                                                                                                                                                                                                              Function 00007FF6113093B0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2295610775-0
                                                                                                                                                                                                                              • Opcode ID: 59c1ec81a29a6fab549a8afeeca284bc4e0314e0ec4df424a70acac61bdd8c3c
                                                                                                                                                                                                                              • Instruction ID: 911223ba2b06bfe54a495350715599a45f4ae040ae2179c3ebef1167a2d09539
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59c1ec81a29a6fab549a8afeeca284bc4e0314e0ec4df424a70acac61bdd8c3c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCF03029A19A4181F7A0AB70B4083696790A784BB8F804734DABD816D8DF7C8149CB40
                                                                                                                                                                                                                              Function 00007FF611301D40 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 139COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 63 7ff611301d40-7ff611301d59 64 7ff611301f40-7ff611301f47 call 7ff611302e60 63->64 65 7ff611301d5f-7ff611301d63 63->65 69 7ff611301f4c-7ff611301f51 64->69 67 7ff611301e60-7ff611301e69 call 7ff611301ca0 65->67 68 7ff611301d69-7ff611301d82 call 7ff611308590 65->68 72 7ff611301e6b-7ff611301e79 67->72 77 7ff611301eb8-7ff611301ec8 call 7ff611302e60 67->77 75 7ff611301d88-7ff611301d9e call 7ff611304650 68->75 76 7ff611301f56-7ff611301f6c call 7ff611302fe0 68->76 69->72 84 7ff611301da4-7ff611301db6 call 7ff611310020 75->84 85 7ff611301ed0-7ff611301ee4 call 7ff611302e60 75->85 76->69 77->72 90 7ff611301f20-7ff611301f31 call 7ff611302fe0 84->90 91 7ff611301dbc-7ff611301dc0 84->91 92 7ff611301e9b-7ff611301eb1 fclose 85->92 96 7ff611301f36-7ff611301f3b 90->96 94 7ff611301e80-7ff611301e8c call 7ff611301710 91->94 95 7ff611301dc6-7ff611301dd6 malloc 91->95 101 7ff611301e91 94->101 98 7ff611301f6e-7ff611301f84 call 7ff611302fe0 95->98 99 7ff611301ddc-7ff611301de2 95->99 100 7ff611301e93-7ff611301e96 fclose 96->100 98->96 102 7ff611301de4 99->102 103 7ff611301e16-7ff611301e39 fread 99->103 100->92 101->100 105 7ff611301ef0-7ff611301ef2 102->105 106 7ff611301df0-7ff611301e07 fwrite 103->106 107 7ff611301e3b-7ff611301e4c call 7ff611302fe0 103->107 112 7ff611301e56-7ff611301e5e free 105->112 109 7ff611301f00-7ff611301f16 call 7ff611302fe0 106->109 110 7ff611301e0d-7ff611301e10 106->110 113 7ff611301e51 107->113 109->113 110->103 110->105 112->100 113->112
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fclose$_wfopenfreadfreemalloc
                                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                                              • API String ID: 414440483-3833288071
                                                                                                                                                                                                                              • Opcode ID: b8326de1dd1da5a01a039f0c6865c55c65bdf7ac7e71c07fea9abcbacca4f40a
                                                                                                                                                                                                                              • Instruction ID: 4b9eb521ea7793155c10e2113c74a54d2ecae7714d3d2acfba578de245b604be
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8326de1dd1da5a01a039f0c6865c55c65bdf7ac7e71c07fea9abcbacca4f40a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 69518021E0DD5741FB15972598506FA12A9AF14FF8F88023AED0DCB2DEEE6CE949C340
                                                                                                                                                                                                                              Function 00007FF611309210 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                              • API String ID: 1339360106-2855260032
                                                                                                                                                                                                                              • Opcode ID: 840785790ae47b5b900202a130df978d56d1b00df71af0a86b378aa74ba62265
                                                                                                                                                                                                                              • Instruction ID: 370e3472d99b040be8d805f18e9f9b5db98e5ff1070d36b127e2876611467d72
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 840785790ae47b5b900202a130df978d56d1b00df71af0a86b378aa74ba62265
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5318121708A4682E710AB61F8047AA63A9FB85FB4F140235EE6DC7AD8EF7CE445C740
                                                                                                                                                                                                                              Function 00007FF61130F3B0 Relevance: 25.8, APIs: 17, Instructions: 341COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 131 7ff61130f3b0-7ff61130f3d7 call 7ff611319288 134 7ff61130f3e9-7ff61130f402 setlocale 131->134 135 7ff61130f3d9-7ff61130f3e5 _strdup 131->135 136 7ff61130f408-7ff61130f411 134->136 137 7ff61130f824-7ff61130f89a wcstombs realloc wcstombs setlocale free 134->137 135->134 136->137 138 7ff61130f417-7ff61130f4ab mbstowcs call 7ff61130f020 mbstowcs 136->138 139 7ff61130f8a1-7ff61130f8a7 137->139 142 7ff61130f4ad-7ff61130f4b8 138->142 143 7ff61130f514-7ff61130f519 138->143 146 7ff61130f4c7-7ff61130f4dc 142->146 147 7ff61130f4ba-7ff61130f4c5 142->147 144 7ff61130f51b-7ff61130f52a 143->144 145 7ff61130f534-7ff61130f53e 143->145 144->145 148 7ff61130f52c-7ff61130f531 144->148 149 7ff61130f81a-7ff61130f81d 145->149 150 7ff61130f544-7ff61130f554 145->150 151 7ff61130f4de-7ff61130f4ec 146->151 152 7ff61130f533 146->152 147->143 147->146 148->145 149->137 154 7ff61130f5aa-7ff61130f5b4 150->154 151->152 153 7ff61130f4ee-7ff61130f50f setlocale free 151->153 152->145 155 7ff61130f81f-7ff61130f822 153->155 156 7ff61130f556-7ff61130f561 154->156 157 7ff61130f5b6 154->157 155->139 159 7ff61130f577-7ff61130f582 156->159 160 7ff61130f563-7ff61130f56e 156->160 158 7ff61130f5b9-7ff61130f5c1 157->158 161 7ff61130f5c8-7ff61130f5d5 158->161 162 7ff61130f5c3-7ff61130f76c 158->162 165 7ff61130f572 159->165 166 7ff61130f584-7ff61130f58f 159->166 163 7ff61130f570 160->163 164 7ff61130f5a5 160->164 168 7ff61130f5d7-7ff61130f5e2 161->168 169 7ff61130f5f1-7ff61130f5f9 161->169 171 7ff61130f77b-7ff61130f780 162->171 172 7ff61130f76e-7ff61130f779 162->172 163->159 164->154 165->159 166->165 170 7ff61130f591-7ff61130f59b 166->170 168->161 173 7ff61130f5e4-7ff61130f5ef 168->173 174 7ff61130f5fb-7ff61130f606 169->174 175 7ff61130f653-7ff61130f669 169->175 176 7ff61130f5b8 170->176 177 7ff61130f59d-7ff61130f5a1 170->177 180 7ff61130f793-7ff61130f7f2 wcstombs realloc wcstombs 171->180 172->171 179 7ff61130f782-7ff61130f78e 172->179 173->161 173->169 181 7ff61130f608-7ff61130f613 174->181 182 7ff61130f615-7ff61130f62a 174->182 178 7ff61130f670-7ff61130f67b 175->178 176->158 177->164 183 7ff61130f66b 178->183 184 7ff61130f67d-7ff61130f688 178->184 179->180 185 7ff61130f7f7-7ff61130f818 setlocale free 180->185 181->175 181->182 182->175 186 7ff61130f62c-7ff61130f63b 182->186 183->178 184->183 187 7ff61130f68a-7ff61130f696 184->187 185->155 186->175 188 7ff61130f63d-7ff61130f64c 186->188 189 7ff61130f698-7ff61130f6aa 187->189 190 7ff61130f6ac-7ff61130f6b0 187->190 188->175 191 7ff61130f64e 188->191 189->190 192 7ff61130f6b4-7ff61130f6bc 189->192 190->192 191->175 193 7ff61130f713-7ff61130f71d 192->193 194 7ff61130f6be-7ff61130f6db 193->194 195 7ff61130f71f-7ff61130f748 wcstombs 193->195 196 7ff61130f6f9-7ff61130f704 194->196 197 7ff61130f6dd-7ff61130f6f0 194->197 195->185 198 7ff61130f74e-7ff61130f75c 195->198 200 7ff61130f706-7ff61130f711 196->200 201 7ff61130f6f4 196->201 197->193 199 7ff61130f6f2 197->199 198->185 199->196 200->193 200->201 201->196
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 918573998-0
                                                                                                                                                                                                                              • Opcode ID: bc37caea81c3f1b4857c0da5a89418885bf617b27b1e748d0f14d2c635658186
                                                                                                                                                                                                                              • Instruction ID: 8f5bee2cb25e0e19cbce18612337648e828bf28c2b5ca53fac248c82cb0a813c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bc37caea81c3f1b4857c0da5a89418885bf617b27b1e748d0f14d2c635658186
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 65F1F866F04B1989EB509BAAD4412BC27F9FB48FA8F804436DE4CA7798EF38D451C351
                                                                                                                                                                                                                              Function 00007FF611301710 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 231fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 202 7ff611301710-7ff61130177d call 7ff61130a920 205 7ff611301783-7ff611301793 malloc 202->205 206 7ff611301a58-7ff611301a70 call 7ff611302e60 202->206 208 7ff611301799-7ff6113017a9 malloc 205->208 209 7ff611301ab7-7ff611301ace call 7ff611302fe0 205->209 217 7ff611301a75-7ff611301a93 206->217 212 7ff6113017af-7ff6113017cd 208->212 213 7ff611301a98-7ff611301aaa call 7ff611302fe0 208->213 218 7ff611301aaf 209->218 216 7ff6113017d5-7ff6113017f7 fread 212->216 213->218 219 7ff611301a30-7ff611301a39 216->219 220 7ff6113017fd-7ff611301807 ferror 216->220 221 7ff6113019d0-7ff6113019d8 217->221 218->209 224 7ff611301a41-7ff611301a53 219->224 220->219 222 7ff61130180d-7ff61130182e 220->222 223 7ff611301928-7ff61130192a 221->223 225 7ff611301831-7ff61130184d call 7ff61130a9d0 222->225 223->225 226 7ff611301930-7ff611301951 223->226 227 7ff61130187f-7ff611301892 call 7ff611302e60 224->227 233 7ff61130184f-7ff611301852 225->233 234 7ff611301868-7ff61130186b 225->234 230 7ff611301ad0-7ff611301adb 226->230 231 7ff611301957-7ff61130195a 226->231 240 7ff611301897-7ff6113018c4 call 7ff61130c780 free * 2 227->240 231->216 235 7ff611301960-7ff611301977 231->235 237 7ff611301854-7ff611301863 233->237 238 7ff6113018c8-7ff6113018e1 233->238 234->238 241 7ff61130186d-7ff61130187c 234->241 239 7ff61130197d 235->239 235->240 237->227 243 7ff611301988-7ff611301991 238->243 244 7ff6113018e7-7ff611301909 fwrite 238->244 239->227 241->227 243->223 245 7ff611301993-7ff611301997 243->245 244->224 247 7ff61130190f-7ff61130191e ferror 244->247 248 7ff6113019e0-7ff611301a26 245->248 249 7ff611301999-7ff61130199d 245->249 247->224 250 7ff611301924 247->250 248->221 249->217 251 7ff6113019a3-7ff6113019a6 249->251 250->223 251->221 252 7ff6113019a8-7ff6113019b9 251->252 252->221 253 7ff6113019bb-7ff6113019cf 252->253 253->221
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc$ferrorfree$freadfwrite
                                                                                                                                                                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                              • API String ID: 1635854594-1655038675
                                                                                                                                                                                                                              • Opcode ID: c7dad65b08eccfe109ea056ce5c20d395fae7623f7bcb11bc371ddcf49c6912d
                                                                                                                                                                                                                              • Instruction ID: 0f5177cb95451457f0e952c0fc06814180a0d22c16884b2a576d92242c99b95f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c7dad65b08eccfe109ea056ce5c20d395fae7623f7bcb11bc371ddcf49c6912d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8791CF22B08A9641E7208F12A8403BA66E8BB45FF4F544231DE9DD3BDDEE7CE585D700
                                                                                                                                                                                                                              Function 00007FF611308820 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99processsynchronizationCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_osfhandle$Process_fileno$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                              • API String ID: 2399235724-3524285272
                                                                                                                                                                                                                              • Opcode ID: 2bb69f242d9541d69d1b049c92316138750a043074f1ee99989ea41868e2982c
                                                                                                                                                                                                                              • Instruction ID: c0089ae21c8403b2a97eafd0122c2a33b277d6032b14fe060f121b25def22bf8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2bb69f242d9541d69d1b049c92316138750a043074f1ee99989ea41868e2982c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D414432A08B8145EB609B64F8557AA73A4EB857B4F404335EAAD877D8EF7CD084C740
                                                                                                                                                                                                                              Function 00007FF6113016D0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 342stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 268 7ff6113016d0-7ff611303ce3 call 7ff611308fe0 call 7ff61130f020 call 7ff6113021d0 276 7ff611304070 268->276 277 7ff611303ce9-7ff611303cfc call 7ff6113045a0 268->277 280 7ff611304080-7ff61130409b call 7ff6113022c0 276->280 277->276 281 7ff611303d02-7ff611303d17 call 7ff611304620 277->281 285 7ff61130409d-7ff6113040ae 280->285 286 7ff611304056-7ff611304068 call 7ff611302e60 280->286 281->276 288 7ff611303d1d-7ff611303d32 call 7ff611307e30 281->288 289 7ff611304100-7ff61130411c call 7ff611309090 285->289 290 7ff6113040b0-7ff6113040ba 285->290 286->276 301 7ff611303e00-7ff611303e18 call 7ff611307f20 call 7ff6113022c0 288->301 302 7ff611303d38-7ff611303d4a call 7ff611307e30 288->302 305 7ff6113042a5-7ff6113042b1 call 7ff611302e60 289->305 306 7ff611304122-7ff611304130 SetDllDirectoryW call 7ff611307020 289->306 293 7ff6113040c0-7ff6113040dc call 7ff611309090 290->293 294 7ff611304228-7ff611304233 call 7ff6113024a0 290->294 293->305 310 7ff6113040e2-7ff6113040f5 SetDllDirectoryW call 7ff611307020 293->310 294->293 308 7ff611304239 294->308 332 7ff611304040-7ff611304050 call 7ff6113022c0 301->332 333 7ff611303e1e-7ff611303e34 301->333 318 7ff611303d50-7ff611303d58 302->318 319 7ff611303f38-7ff611303f50 call 7ff611307f20 call 7ff6113022c0 302->319 305->276 327 7ff611304140-7ff611304155 call 7ff611304650 306->327 308->276 324 7ff611303e63-7ff611303e70 call 7ff611306b90 310->324 322 7ff611303d5e-7ff611303d87 free call 7ff611307f20 * 2 call 7ff6113022c0 318->322 323 7ff611303f28 318->323 351 7ff6113041f8 319->351 352 7ff611303f56-7ff611303f5d 319->352 322->280 381 7ff611303d8d-7ff611303d9e 322->381 323->319 347 7ff611304000-7ff61130400f call 7ff611306d80 324->347 348 7ff611303e76-7ff611303e83 call 7ff611307060 324->348 343 7ff61130415b-7ff6113041a1 call 7ff611308bb0 327->343 344 7ff611304208 327->344 332->286 332->327 339 7ff611303f70 333->339 340 7ff611303e3a-7ff611303e45 call 7ff6113024a0 333->340 345 7ff611303f78-7ff611303f7f 339->345 340->276 358 7ff611303e4b-7ff611303e53 340->358 367 7ff611304292-7ff6113042a0 fclose 343->367 368 7ff6113041a7-7ff6113041bf 343->368 357 7ff61130420e-7ff61130421d call 7ff611302e60 344->357 360 7ff611303f90-7ff611303f9f call 7ff6113036c0 345->360 370 7ff611304023-7ff611304037 call 7ff6113071c0 call 7ff611307060 347->370 371 7ff611304011-7ff61130401d call 7ff611306fa0 347->371 348->360 372 7ff611303e89-7ff611303e9a strcmp 348->372 351->344 352->339 357->276 358->339 366 7ff611303e59 call 7ff611307020 358->366 360->276 386 7ff611303fa5-7ff611303fea call 7ff611307ec0 call 7ff611303c70 call 7ff611308820 call 7ff6113071c0 call 7ff611307060 360->386 384 7ff611303e5e 366->384 367->357 368->345 376 7ff6113041c5-7ff6113041da call 7ff6113024a0 368->376 370->332 371->370 397 7ff611304280-7ff61130428d call 7ff6113072d0 371->397 379 7ff611303ede-7ff611303f07 call 7ff611303bf0 call 7ff611303c00 call 7ff611303c60 call 7ff6113071c0 call 7ff611307060 372->379 380 7ff611303e9c-7ff611303ebf call 7ff611303c80 372->380 376->276 403 7ff6113041e0-7ff6113041e8 376->403 431 7ff611303f0c-7ff611303f21 379->431 380->276 399 7ff611303ec5-7ff611303ed9 strcpy 380->399 389 7ff611303da4 381->389 390 7ff611304250-7ff61130425a 381->390 384->324 433 7ff611304240-7ff611304243 call 7ff611308260 386->433 434 7ff611303ff0-7ff611303ff8 call 7ff611302210 386->434 391 7ff611303daa-7ff611303dd0 call 7ff611309090 389->391 390->293 395 7ff611304260-7ff61130426b call 7ff6113024a0 390->395 391->305 413 7ff611303dd6-7ff611303dec SetDllDirectoryW call 7ff611307020 391->413 395->391 415 7ff611304271 395->415 397->367 399->379 403->366 410 7ff6113041ee 403->410 410->345 413->324 424 7ff611303dee-7ff611303df8 call 7ff611307060 413->424 415->276 424->372 437 7ff611304248 433->437 434->431 437->390
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$DirectoryEnvironmentVariablecalloc$ByteCharFileModuleMultiNameWidestrcmpstrcpy
                                                                                                                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                              • API String ID: 2187479179-3096095006
                                                                                                                                                                                                                              • Opcode ID: 1f15bd69bbc3f3c24b7a495f441c003db60766bb70107ae8481ff2041d2710a3
                                                                                                                                                                                                                              • Instruction ID: 0e977f339c364287317b8045a5fd6242561dea83be5132dfacc858a02cdec789
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f15bd69bbc3f3c24b7a495f441c003db60766bb70107ae8481ff2041d2710a3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6E18F21A0CE4280EB64EB22A9502BB66EDAF44FE0F444135EE4ED77DEDE3CE5058750
                                                                                                                                                                                                                              Function 00007FF611301F90 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freadmalloc$_wfopenfclosefree
                                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 2617120823-2084260460
                                                                                                                                                                                                                              • Opcode ID: 5bce95ee8fb63d5300fe38628ad1002844fa94faa99f8bb8496a8220ff03f0bc
                                                                                                                                                                                                                              • Instruction ID: 6a7e4713da0cd09ce4828a6ce8d251fee3b1e603478eb1b654140d261a6bc9f9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bce95ee8fb63d5300fe38628ad1002844fa94faa99f8bb8496a8220ff03f0bc
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33516C71B09E0682EB189B29D8442B867F9AF88FA4F54823AD90DC779DDF3CE505C744
                                                                                                                                                                                                                              Function 00007FF611308260 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 3789554339-3944641314
                                                                                                                                                                                                                              • Opcode ID: fb5fa8b4530e7b2c41102c59ccc0b32c935fc7947f7e5b4f43b1699e594ef5fd
                                                                                                                                                                                                                              • Instruction ID: 73bab770df99253c07fb571ba9c9c54f1d84fd9bb2a882a5b0dce12228a7bd77
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb5fa8b4530e7b2c41102c59ccc0b32c935fc7947f7e5b4f43b1699e594ef5fd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2721AD52B08D4244EB64A612A8146FE92A8BB86FF0FC84571ED1ED77DEEE3CE445C305
                                                                                                                                                                                                                              Function 00007FF611308590 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$_wfopenstrcpystrtok
                                                                                                                                                                                                                              • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                                              • API String ID: 1482442392-3501660386
                                                                                                                                                                                                                              • Opcode ID: 5fad58f6d195ab0a3039cc78234095d5774b2b1d52e7f46b521baf6d6253a7c3
                                                                                                                                                                                                                              • Instruction ID: 03200e64dd8320341658c664ef6508b1484b7e350b924097a3b7cb6e269cfc5c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5fad58f6d195ab0a3039cc78234095d5774b2b1d52e7f46b521baf6d6253a7c3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A521E060E0CE4785FB20AB25AD142BA22ED5F04FF4F494572EA5DC62DEEE2CE5428200
                                                                                                                                                                                                                              Function 00007FF6113083A0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcscatwcscmp
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3846154227-0
                                                                                                                                                                                                                              • Opcode ID: 540d919613c492cef5aa6eb646dd1b1cb3c8d339fc27a6144501ec21207fb444
                                                                                                                                                                                                                              • Instruction ID: 8e6fd7d5c96a9720805716239bed22239ecd372163d41879fbea657f466d91d8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 540d919613c492cef5aa6eb646dd1b1cb3c8d339fc27a6144501ec21207fb444
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A116D14E08E428AFB64AB22A8102FE13DC5F84FE4F0840B1DD0EC66DEEE6CE5018301
                                                                                                                                                                                                                              Function 00007FF611308480 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$strcpystrtok
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3698421117-0
                                                                                                                                                                                                                              • Opcode ID: 86c057e636391070db3999e02b4ec4b0961dea1a697d128733877af77779c05a
                                                                                                                                                                                                                              • Instruction ID: 3c0976ed524fc1e886d7767cd73579945dea498afd8a60da550a383558e21deb
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 86c057e636391070db3999e02b4ec4b0961dea1a697d128733877af77779c05a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C219011B49E4285FB22A651A8053FA52995F45FF0F880531ED0DC77CEEE3CE556C344
                                                                                                                                                                                                                              Function 00007FF61130A4F0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: mallocmemcpy
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4276657696-0
                                                                                                                                                                                                                              • Opcode ID: 425d4c8a08875ec74439c914d8f05ade38285fd10358b5af06c5e2fac6744273
                                                                                                                                                                                                                              • Instruction ID: 88de212dc3f674f2e69dd41fd447c29670beda3cdc48c3b91330c042b5ef1030
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 425d4c8a08875ec74439c914d8f05ade38285fd10358b5af06c5e2fac6744273
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2B31C472B259418BD7608A26F4846AEB6E5FB84F90F145234DB8AD7F44EE7DF4418B00
                                                                                                                                                                                                                              Function 00007FF611308BB0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freemalloc
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 3061335427-3944641314
                                                                                                                                                                                                                              • Opcode ID: 6e5bc360a876c164f27c815032cb47837420bf40ba37871437629ced47b6ff38
                                                                                                                                                                                                                              • Instruction ID: 31d736820ee6db04093ef4c6f9896fd2b50ee26e50706fd6a4c1a1260301bf2d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e5bc360a876c164f27c815032cb47837420bf40ba37871437629ced47b6ff38
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C21B012B5AD5681FF11DA2299047FAD6A96F45FE8F880471DE0CCB68AEE3DE542C200
                                                                                                                                                                                                                              Function 00007FF611307020 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: calloc
                                                                                                                                                                                                                              • String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                                              • API String ID: 2635317215-799113134
                                                                                                                                                                                                                              • Opcode ID: f2af3c9f5e49862c4fdb12449ad5d52b59e493735a903b8862745a60d1d68c81
                                                                                                                                                                                                                              • Instruction ID: a4db885e7fb9adeb9a252c813abdb801886f8b64749be8aa9518b9d365af448b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2af3c9f5e49862c4fdb12449ad5d52b59e493735a903b8862745a60d1d68c81
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBE01265E08E0280EF159710A4511B923A8FF85BA4F944138DA4CC77EDED3CE545CB84
                                                                                                                                                                                                                              Function 00007FF6113022C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 93stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcpy
                                                                                                                                                                                                                              • String ID: pyi-contents-directory
                                                                                                                                                                                                                              • API String ID: 3177657795-2617349511
                                                                                                                                                                                                                              • Opcode ID: 5bf9b9d7ed3ee3d6fd6229c4798420956e625b75858e8fae20c676d5f28f119e
                                                                                                                                                                                                                              • Instruction ID: beb355618fcbd02f6dbb066d42b8b7063f3f3d2d4380c325e3a1015924a389ef
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bf9b9d7ed3ee3d6fd6229c4798420956e625b75858e8fae20c676d5f28f119e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA318362B09E8284FB619A65E8083F91399AF44FE4F484131ED0DCB78EDE3CE545C710
                                                                                                                                                                                                                              Function 00007FF611310060 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fsetpos
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 850078086-0
                                                                                                                                                                                                                              • Opcode ID: 465717a23ec0afd49ac1cc4503031fffc665e619fc2808689674e9d738e7ebcb
                                                                                                                                                                                                                              • Instruction ID: 8fbe51eea9154128745f2afa209e5bb9ad3423301091d52a15b8e6968331372a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 465717a23ec0afd49ac1cc4503031fffc665e619fc2808689674e9d738e7ebcb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD113376F04F469AEB109F7588450AC33B8AB09BA8F504A35EE5D8779DDF38D1918350
                                                                                                                                                                                                                              Function 00007FF61130FF1B Relevance: 2.6, APIs: 2, Instructions: 67COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freememsetwcslen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2332356550-0
                                                                                                                                                                                                                              • Opcode ID: c2e1b32b20ba580d70b52182103e0aee796dda81a15ec91a94acdf2495544fb0
                                                                                                                                                                                                                              • Instruction ID: c57a86ef9d78d6b86cf63e6b8d1460ce5ac0b377950596c0c4f38e4305235a93
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c2e1b32b20ba580d70b52182103e0aee796dda81a15ec91a94acdf2495544fb0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE31B466B04B1489EB14CF7AD48109C3BB5FB98BA8B108526EE1C57B6CEB38C591C790
                                                                                                                                                                                                                              Function 00007FF61130FC50 Relevance: 2.5, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpymemset
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1297977491-0
                                                                                                                                                                                                                              • Opcode ID: 5d324b82e055cafc44ef2489a603cddb014aa3137ca6904158de945bf2753727
                                                                                                                                                                                                                              • Instruction ID: 35cf5c01a2dc5a6fd9c37bdfc83903c8077d85e5d88506520d68970e78520929
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5d324b82e055cafc44ef2489a603cddb014aa3137ca6904158de945bf2753727
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1C21F476B40B8689DB64CF6AD8843ED37B5FB49BA8F018126CE2C5BB58DE34C641C740
                                                                                                                                                                                                                              Function 00007FF61130FB70 Relevance: 2.5, APIs: 2, Instructions: 46COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpymemset
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1297977491-0
                                                                                                                                                                                                                              • Opcode ID: 86a4f9779090a5a3b7ad0aee4b266cf8ba49ffbde6d478c0951e5b4311ae9909
                                                                                                                                                                                                                              • Instruction ID: bf945f19ddbcfe00457798748ceb40312958f666c80b793c315a6a45f4afbd73
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 86a4f9779090a5a3b7ad0aee4b266cf8ba49ffbde6d478c0951e5b4311ae9909
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2521E876B40F8A89DB64CF69D8843ED33A5E749BB8F114225CE3C5BB98DE34C5418340
                                                                                                                                                                                                                              Function 00007FF611304650 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              • _wfopen.MSVCRT ref: 00007FF611304695
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 372205238-0
                                                                                                                                                                                                                              • Opcode ID: 8e21174acb464d8d1757056906152d011765c52c98c26f0b73aa27ab55bd4878
                                                                                                                                                                                                                              • Instruction ID: 6b06dd2b62576c8f81ae7b8d371d63d0cc2b2708278ba82037bfd7d4375f0b85
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e21174acb464d8d1757056906152d011765c52c98c26f0b73aa27ab55bd4878
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90E09251B0861041EA14A222A9143E9829A6F49FE0F448030EE0C9BB8E9D1DD2438701
                                                                                                                                                                                                                              Function 00007FF61130B150 Relevance: 1.4, APIs: 1, Instructions: 135COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpy
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3510742995-0
                                                                                                                                                                                                                              • Opcode ID: 885c1ada9ef54120341bcedc4c9a71be298787a9b6042cca5f6a765c25f5e263
                                                                                                                                                                                                                              • Instruction ID: 02b1ece8e128eee68243e40d2cf9aa4b6da6929ae2f8462f1086f02b4006af70
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 885c1ada9ef54120341bcedc4c9a71be298787a9b6042cca5f6a765c25f5e263
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6B51C737A196828BD7558E19E488A2F77EDFB44BA4F158139DA45C3A98CF38D881CB00
                                                                                                                                                                                                                              Function 00007FF61130D990 Relevance: 1.3, APIs: 1, Instructions: 76COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memset
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2221118986-0
                                                                                                                                                                                                                              • Opcode ID: a1c7189d00abfc9b8276c972b3be7d95addfd7c87cd30e887ec7055d5bdc4fb6
                                                                                                                                                                                                                              • Instruction ID: 63dee087bdf0a544bbbe868f2dc468b06e5b9f19f7c972023103ac7626a25950
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c7189d00abfc9b8276c972b3be7d95addfd7c87cd30e887ec7055d5bdc4fb6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6131F326F08B1599FB109BA6D4443BC37F8A704BA8F904076DE8CA7B98DF3C9691C754
                                                                                                                                                                                                                              Function 00007FF61130A920 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2803490479-0
                                                                                                                                                                                                                              • Opcode ID: 70144d6ec82bfe141b5cbf93c26a1062560a1e9f03a4e2e5c767b20eb75f5ad6
                                                                                                                                                                                                                              • Instruction ID: 36b0b58fb2304a27edfa2adfe9f5b024120aca135dc81ba736022c0fecf52110
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70144d6ec82bfe141b5cbf93c26a1062560a1e9f03a4e2e5c767b20eb75f5ad6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0216D22B09E0686EB614B19A4403393AD9AB44FF4F294334C94EC73D8DF39D983D340

                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                              Function 00007FF611307680 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 324libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                              • API String ID: 190572456-2208601799
                                                                                                                                                                                                                              • Opcode ID: bd663cd79cc008e1fc6f487746503f053cd2f66c41a095d1ba5e11cdaee36601
                                                                                                                                                                                                                              • Instruction ID: 4ae7d2a216f3e0059a1e070bf8d7edda1573c9c8b6ae2da92e8bd57570d55d0d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd663cd79cc008e1fc6f487746503f053cd2f66c41a095d1ba5e11cdaee36601
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 85F17360A0DF0790FF16EB28A8550B423ADAF55FB0B945436D44EC62ADEF7CE64AC350
                                                                                                                                                                                                                              Function 00007FF611302710 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                                              • String ID: $BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                              • API String ID: 3223904152-1365983254
                                                                                                                                                                                                                              • Opcode ID: 23d76df661166ccc8bf8808f21f1e890a82357284aeaf219810838731c85fa8c
                                                                                                                                                                                                                              • Instruction ID: 71ff43d844c84a8a613212993264d43aaf56f03bbba0739b1e19ffdf6de324d7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23d76df661166ccc8bf8808f21f1e890a82357284aeaf219810838731c85fa8c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 58917736218B9582E7508F61E45479A7764F788BD8F24413AEE8C4BB9CCF7EC185CB50
                                                                                                                                                                                                                              Function 00007FF611308CD0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                              • API String ID: 1653872744-2573406579
                                                                                                                                                                                                                              • Opcode ID: 024fbe4156dcd0bd8b1afa62f143db975c9d56f4e4c52d1d88309cd898284ba8
                                                                                                                                                                                                                              • Instruction ID: c9ac70e996a78456ca74bd52e1d2cbdda75d1d182bfa108752427fcce29453be
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 024fbe4156dcd0bd8b1afa62f143db975c9d56f4e4c52d1d88309cd898284ba8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F421A571E0CE0281F720AB14F8583AA23A8BF55BB4F844534EA4DC66ACEF3CD549C700
                                                                                                                                                                                                                              Function 00007FF6113015E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                                              • String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                                              • API String ID: 384173800-1835852900
                                                                                                                                                                                                                              • Opcode ID: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
                                                                                                                                                                                                                              • Instruction ID: 93bfa6b5016b5c9158fa77e4a97cc2c9e01a359e92fd018dc08700346b207ebe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B5017E25A0AE1B95EB25AB15BC505B423A8BF49FF5F884131D80ED736CAF2CE54AC340
                                                                                                                                                                                                                              Function 00007FF611315D5A Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 1364COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: Infinity$NaN
                                                                                                                                                                                                                              • API String ID: 0-4285296124
                                                                                                                                                                                                                              • Opcode ID: beb020b211eaaca1f32f7ce65c3d9009a7195868fcd7db736676572f372752d4
                                                                                                                                                                                                                              • Instruction ID: e54f2f3a109da1592c8b37d48c7c300ef4054ff5412b469f7aab858d5894ea82
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: beb020b211eaaca1f32f7ce65c3d9009a7195868fcd7db736676572f372752d4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BCE22672A04B858EE751CFB9C4442AC37B9FB45BA8F148225EA0D97B5DDF78E481CB40
                                                                                                                                                                                                                              Function 00007FF61130B458 Relevance: 3.9, Strings: 3, Instructions: 138COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: incorrect header check$invalid window size$unknown compression method
                                                                                                                                                                                                                              • API String ID: 0-1186847913
                                                                                                                                                                                                                              • Opcode ID: 4496b91970aba0857bed3007b949b9b7e2b63f9dde9968431ed31718af5f9cf1
                                                                                                                                                                                                                              • Instruction ID: e2a983b76a32b9b17178149b9e4158321bd8b09f415521fe6eb24b6f9aff4b0a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4496b91970aba0857bed3007b949b9b7e2b63f9dde9968431ed31718af5f9cf1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6751D476A18B168BE7688E24948C53E36EDEB44B90F118139DB1EC7788DF3CE905DB04
                                                                                                                                                                                                                              Function 00007FF61130B478 Relevance: 1.5, APIs: 1, Instructions: 253COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 1fa4ac71a5e31e2cc150ff49e4ee7ea9fb9e70d7c6dba1bfe7d3f5ad9a10a4b2
                                                                                                                                                                                                                              • Instruction ID: 2f56806fa9027c50701d10015d3b5b0034a5a2b2b280206c0f0006c35e1b6c1f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1fa4ac71a5e31e2cc150ff49e4ee7ea9fb9e70d7c6dba1bfe7d3f5ad9a10a4b2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47B18076E08A518AE7698F149048B3A7BE9EB85BA4F154138DF4DC7B8CDF39D900CB40
                                                                                                                                                                                                                              Function 00007FF61130D100 Relevance: .3, Instructions: 336COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 82756fd2ac5761be83388b480f9d5e46744741ce7b61d765b3fcf86fb2cc7fb8
                                                                                                                                                                                                                              • Instruction ID: e68c483f4ed0dd3e1a9e2b9c9fbc1b1a9613480910b59918f00109ff08243364
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82756fd2ac5761be83388b480f9d5e46744741ce7b61d765b3fcf86fb2cc7fb8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ABE1C533A1CA9286D7658F14E00427EB7E4FB94B68F454135EA8AD3B98DF3DE944CB00
                                                                                                                                                                                                                              Function 00007FF611309A60 Relevance: .3, Instructions: 281COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: ee928d4349295dd83296cb3ffc0a74822f4b4d78fe9c71e83768e58e224ea547
                                                                                                                                                                                                                              • Instruction ID: 180a6d855534ee18619feb45891d3e60f79152cff8a8e4688e7bcf09976170ad
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee928d4349295dd83296cb3ffc0a74822f4b4d78fe9c71e83768e58e224ea547
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2CA1F773B245A047EF54CB2A941467A7BE2F74ABA1B84E231DF8D87788DA3DE415C700
                                                                                                                                                                                                                              Function 00007FF611329618 Relevance: .0, Instructions: 7COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 64c548e54cdb996a2b16215551ee39b84b181e4f79eb41d6fe7a4830435a94d8
                                                                                                                                                                                                                              • Instruction ID: 21e9586169b9d30194ec7a1905af98ffb622e58fc59f065719672d38b9d8742b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 64c548e54cdb996a2b16215551ee39b84b181e4f79eb41d6fe7a4830435a94d8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1BC0125BD0EAE10AE270472808A802C2BC0EBA1E34B080078C284863D2A85A240A8B00
                                                                                                                                                                                                                              Function 00007FF6113059C0 Relevance: 233.2, APIs: 44, Strings: 89, Instructions: 451libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                              • API String ID: 190572456-4266016200
                                                                                                                                                                                                                              • Opcode ID: 50e6ba4ab6fb6236e3085a79b8dda0dff8723994d665336298622606d247f3f2
                                                                                                                                                                                                                              • Instruction ID: 7968e8721a7397b5826d877ad782a8669c129fe8c64f7ffa4e4c6d67a4746fe7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 50e6ba4ab6fb6236e3085a79b8dda0dff8723994d665336298622606d247f3f2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7132B260A5DF0790EF19DB14A8511B823BDBF44BA0B94903AC44EC26ADEF7CF609D351
                                                                                                                                                                                                                              Function 00007FF6113037E0 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                                              • API String ID: 1294909896-4198433784
                                                                                                                                                                                                                              • Opcode ID: 900ce7977e4f46f4bc27d2a17498c34b4b329bf408e99df8640a570d0382665c
                                                                                                                                                                                                                              • Instruction ID: 56c776225090d59bfb3fa0882e7a3a49fa7be6b75401942f9dbc3034880c9aa5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 900ce7977e4f46f4bc27d2a17498c34b4b329bf408e99df8640a570d0382665c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E8B13F29B09F4A85EB14AB26E85417A23B9BF89FE4F444032DD1EC7768DE3CE505D340
                                                                                                                                                                                                                              Function 00007FF61130F060 Relevance: 25.7, APIs: 17, Instructions: 211COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1093732947-0
                                                                                                                                                                                                                              • Opcode ID: 4057a5c6bd61162031fd582af2eb34abd572d533eb0d544b39b7c2850e9da645
                                                                                                                                                                                                                              • Instruction ID: 358843187ec5ca5b56c6696eb846954c362f31337e0b70162652fa30255411a7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4057a5c6bd61162031fd582af2eb34abd572d533eb0d544b39b7c2850e9da645
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43A12666B05F1989EB509BA6D8402BC33F8BB49FA8F404539DE5CA7B99EF3CD4018351
                                                                                                                                                                                                                              Function 00007FF611303340 Relevance: 25.7, APIs: 2, Strings: 15, Instructions: 196stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF6113032D0: strcpy.MSVCRT(00000000,?,_MEIPASS2,00000000,00007FF611303721), ref: 00007FF611303313
                                                                                                                                                                                                                              • strcmp.MSVCRT ref: 00007FF61130348A
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmpstrcpystrlen
                                                                                                                                                                                                                              • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive path exceeds PATH_MAX$Failed to copy file %s from %s!$Failed to extract %s from referenced dependency archive %s.$Failed to open archive %s!$Failed to open referenced dependency archive %s.$Referenced dependency archive %s not found.$\$\$_MEIPASS2$pyi-contents-directory
                                                                                                                                                                                                                              • API String ID: 895318938-459211576
                                                                                                                                                                                                                              • Opcode ID: fd39c2760308aef11e2db745e75fa541c5fb47fde11d8f7162a83a1c834ded2e
                                                                                                                                                                                                                              • Instruction ID: 73cb16085dd900b7f67e777171b74fab2e3f0943e2e617497ff1a57581833976
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fd39c2760308aef11e2db745e75fa541c5fb47fde11d8f7162a83a1c834ded2e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C814A25A0CE4689EB249B21E8446BB63ADAF44FF4F444132EA4DD77DEDE2CE506C740
                                                                                                                                                                                                                              Function 00007FF6113049F0 Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 203stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocstrcmpstrncmp
                                                                                                                                                                                                                              • String ID: _MEIPASS2$dev$hash_seed$optimize$pyi-$unbuffered$utf8$verbose
                                                                                                                                                                                                                              • API String ID: 3864021093-2470803696
                                                                                                                                                                                                                              • Opcode ID: 451d73b7ff344c03704b212d97ce530da948a4f6c025c6dc93e866c2767be9a3
                                                                                                                                                                                                                              • Instruction ID: 43dd1adee11f9c95113bd6cf3815a60c00f1d351f4db543391c28fa7c551f445
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 451d73b7ff344c03704b212d97ce530da948a4f6c025c6dc93e866c2767be9a3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C819562E0CE4256FF65DB22A40437A6AE9AF45F78F448035CA4DC66CDDF7CE6858304
                                                                                                                                                                                                                              Function 00007FF611301B30 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 89COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _wfopenfclosefreadfreemalloc
                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$_MEIPASS2$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 3354994319-975985129
                                                                                                                                                                                                                              • Opcode ID: 2abe935b5ea5116503a70314594df6f61392fc82d382527488ef19b0ba87d799
                                                                                                                                                                                                                              • Instruction ID: 19ba8768eb761e48cedd2b0abc945a7dccd61e1ec89d696ce9ab765ff50e25e5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2abe935b5ea5116503a70314594df6f61392fc82d382527488ef19b0ba87d799
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9319E51B09E1B51FF19A7119854AFA12ACAF14FF8F844036EC0DC769EEE6CE50AC300
                                                                                                                                                                                                                              Function 00007FF611302B90 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 71windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                              • API String ID: 3963799495-2699770090
                                                                                                                                                                                                                              • Opcode ID: 63ee56fe181a1917596a2b7ec1c70eb69a51c0cc73ba7970fc3e78cbc600a575
                                                                                                                                                                                                                              • Instruction ID: a23022fd173faae4c7dabd0f3f57d8b74b144ae53c7ae6608eb2e7cf232be820
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 63ee56fe181a1917596a2b7ec1c70eb69a51c0cc73ba7970fc3e78cbc600a575
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE215136B09E8581EB65EB62B8546EB6368FBC9FA0F440135EE4E87B49DE3CD045C740
                                                                                                                                                                                                                              Function 00007FF611306450 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 122COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocfflush$strcmpstrncmp
                                                                                                                                                                                                                              • String ID: Failed to allocate PyConfig structure! Unsupported python version?$Failed to parse run-time options!$Failed to pre-initialize embedded python interpreter!$Failed to set module search paths!$Failed to set program name!$Failed to set python home path!$Failed to set run-time options!$Failed to set sys.argv!$Failed to start embedded python interpreter!
                                                                                                                                                                                                                              • API String ID: 2710203250-3807717293
                                                                                                                                                                                                                              • Opcode ID: 20069458dbc6cbfea570bcd6b724cb1ff9c6197de144f72581953467c1bf7855
                                                                                                                                                                                                                              • Instruction ID: 1117b7a542243e7d961cb3f266d51af83b42f4c675e4a000774ed07a24314ea8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20069458dbc6cbfea570bcd6b724cb1ff9c6197de144f72581953467c1bf7855
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B051F850A0CE5781FB15AB29E8551B953EDAF80FF4F541132EE4EC62EEEE2DE9059300
                                                                                                                                                                                                                              Function 00007FF611306D80 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlenstrncpy$callocfreememcpy
                                                                                                                                                                                                                              • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 4189425833-927121926
                                                                                                                                                                                                                              • Opcode ID: fa06c1771d126537b0c576a2152c8899150302a8b01afd59cc48e191a0e66960
                                                                                                                                                                                                                              • Instruction ID: 507705ac32582b1ea7933cbfe9e5517200da6e8b4514d1ff1b5df0d82a5cbdd0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa06c1771d126537b0c576a2152c8899150302a8b01afd59cc48e191a0e66960
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3641C592708E4255EB18EA22D9042FB63A9BF45FE4F844135EE1DC778EDE2CE656C300
                                                                                                                                                                                                                              Function 00007FF611306B90 Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 114stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpystrncpy$malloc$callocfree
                                                                                                                                                                                                                              • String ID: Cannot allocate memory for necessary files.$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 1819673767-1389504347
                                                                                                                                                                                                                              • Opcode ID: 6abde95e514940232a5d18ebf8d6e33772cb9ca00dbb0a1e4aaf4026809cc789
                                                                                                                                                                                                                              • Instruction ID: 1dc04f59f199458a8da713bedb3bcb0f6aec249f024fcfc4dd4aec9ef68358b0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6abde95e514940232a5d18ebf8d6e33772cb9ca00dbb0a1e4aaf4026809cc789
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8341E4A2B05A0657EB18EA22D9442E9B3A9FB44FA0F544530DF1D87B89EF7CE1528300
                                                                                                                                                                                                                              Function 00007FF611302500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                              • Opcode ID: 6e54ce7222580e4a214d1a9fc401257ee609a80b666226e2997e335eb7f2f95f
                                                                                                                                                                                                                              • Instruction ID: bbe6ee1b6d3a3a77068812d9bbd6c62cec49c7f5faf5a80af74b795f75b0360c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e54ce7222580e4a214d1a9fc401257ee609a80b666226e2997e335eb7f2f95f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47418776214BA186D7208F36E408779B7A5F788F99F084231EE8987B59EF3CD145CB20
                                                                                                                                                                                                                              Function 00007FF6113086B0 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fclose$clearerrferror$_wfopenfreadfwrite
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4075948245-0
                                                                                                                                                                                                                              • Opcode ID: d078c9525b3220c8e229ac5f92ee0f03a0fc95d342679d59fcabbb94bb70f7c3
                                                                                                                                                                                                                              • Instruction ID: dad51293285be833ac92c51cc72ebd40228db87bdf95f3a57c87f9ce257a7fda
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d078c9525b3220c8e229ac5f92ee0f03a0fc95d342679d59fcabbb94bb70f7c3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D21F310E09A4341FA29A6226A193F942D90F46FF0E5801B4ED1EDB7CEEE2CE9524341
                                                                                                                                                                                                                              Function 00007FF611312D4B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
                                                                                                                                                                                                                              • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                                              • API String ID: 1485978544-2115465065
                                                                                                                                                                                                                              • Opcode ID: 5a4758fc2b7250ab57d84d915ac7ea9a8d289e4afafd195f03aed32c1a1e0ffa
                                                                                                                                                                                                                              • Instruction ID: 75f8b3f023b56bbab9ca2e055c262703fd6de8f728d65a6eca5afd5a5e8b14ab
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a4758fc2b7250ab57d84d915ac7ea9a8d289e4afafd195f03aed32c1a1e0ffa
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C781D776A04B498EEB14CF6AC8806AC77B4F748FA8F118525EE5D87B58DF38D510CB50
                                                                                                                                                                                                                              Function 00007FF611308EC0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                              • API String ID: 1374691127-27947307
                                                                                                                                                                                                                              • Opcode ID: 610e830cc156b7b5144b5e984da796cd542280474a5d718d75e7e6b0456d95c9
                                                                                                                                                                                                                              • Instruction ID: a54531b54b36b916956c4e85298a8d55651bc6033303cff3e661cfbe370874ae
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 610e830cc156b7b5144b5e984da796cd542280474a5d718d75e7e6b0456d95c9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B121B361B09F4284FB10EB65B85437A6299AF85BF4F444639EA4DCB6DDEF7CE1088300
                                                                                                                                                                                                                              Function 00007FF611308DD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                                              • API String ID: 1374691127-3831141058
                                                                                                                                                                                                                              • Opcode ID: 3053fae4ff6c96a7205fc05c2f0ab597f00dd46bdd9511d4cab0f019121f0fe5
                                                                                                                                                                                                                              • Instruction ID: 2f3b467799820a6602a7dd90b9976d695f1a60aad8dd9ce4870ce1520556efea
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3053fae4ff6c96a7205fc05c2f0ab597f00dd46bdd9511d4cab0f019121f0fe5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5121C031A0CE4684F710AB65B85836A26E9EB45BF4F844239EA4DC66DDEF7CE104C340
                                                                                                                                                                                                                              Function 00007FF6113089F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                                              • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                                              • API String ID: 4278403329-2782260415
                                                                                                                                                                                                                              • Opcode ID: d96aacef9ed84a949530d77edcfedc7950ec38b60155a97baa6cd5d3fb4306df
                                                                                                                                                                                                                              • Instruction ID: ea8c31593786c9a4929a199a3efa107a26e06077b2887bc8933314cb2c822c43
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d96aacef9ed84a949530d77edcfedc7950ec38b60155a97baa6cd5d3fb4306df
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92119021E09E028AFB11AB64E8455B922A9BF45FB0F544134DE1EC3399FF3CA895C340
                                                                                                                                                                                                                              Function 00007FF611306640 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 102stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freestrlen
                                                                                                                                                                                                                              • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
                                                                                                                                                                                                                              • API String ID: 322734593-568040347
                                                                                                                                                                                                                              • Opcode ID: a5cf2be722d84fc10180f0cf476f1804e4b747426b931160dd73358374bab8d8
                                                                                                                                                                                                                              • Instruction ID: 7bcf295ad4f60ec43ae5b7e1d170a4cc9280a7ab8b1c0b0d48950769be05d882
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a5cf2be722d84fc10180f0cf476f1804e4b747426b931160dd73358374bab8d8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64414166A19E0681EB15AB22E81407963A9BF45FF0B484031DE1DC73A8EF3CE446D340
                                                                                                                                                                                                                              Function 00007FF611304EE0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 88COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: %s%c%s$\$_MEIPASS2$base_library.zip$lib-dynload
                                                                                                                                                                                                                              • API String ID: 626452242-1997419384
                                                                                                                                                                                                                              • Opcode ID: 96eac9c964f75bfd1bb261b00fe75da3a025126ccef3a6a625524ed71a1e8126
                                                                                                                                                                                                                              • Instruction ID: 44ee5af7bd6a5a474c5142f417ca8b8884141367ac5cc770c47755df023e3173
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 96eac9c964f75bfd1bb261b00fe75da3a025126ccef3a6a625524ed71a1e8126
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D9313E22A49E8585EB219B54E8403EA6368FB44BA5F444332DE9DD3ADDDF3CE145C740
                                                                                                                                                                                                                              Function 00007FF611309090 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                              • API String ID: 1374691127-876015163
                                                                                                                                                                                                                              • Opcode ID: 9bafd67a9e6ba27ecb336526dea89acf2ec330839c75d6e55779765ab19282cc
                                                                                                                                                                                                                              • Instruction ID: 0e5664dcbc93563f91497ed99be2fcf6e57de179fa3b7750a91c4c411ad677ae
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9bafd67a9e6ba27ecb336526dea89acf2ec330839c75d6e55779765ab19282cc
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36119061B08E5384FF24EB65A85827912A9AF49BF4F484539DA0DC7AE9EE7CE1048300
                                                                                                                                                                                                                              Function 00007FF6113073C0 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 155COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                                              • API String ID: 1294909896-1126984729
                                                                                                                                                                                                                              • Opcode ID: d97ae4815509cc26e6e973629a1329cac86f451b544e01a121b7f206e9f1a56d
                                                                                                                                                                                                                              • Instruction ID: 834604165c50ab0cdbf02f21e7b2b36c38face2e385bfe232d5022cbfba4ade0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d97ae4815509cc26e6e973629a1329cac86f451b544e01a121b7f206e9f1a56d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F671B83AA08E46D5EB11AF25E9543A933A4FB48FA9F448131DE4E87368DF7CD549C380
                                                                                                                                                                                                                              Function 00007FF6113067B0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen
                                                                                                                                                                                                                              • String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
                                                                                                                                                                                                                              • API String ID: 39653677-372213108
                                                                                                                                                                                                                              • Opcode ID: d4f4f0bb41883a37b964850e9d6525e6c82bda7dc6b4eb7bef36193f41cd0a21
                                                                                                                                                                                                                              • Instruction ID: e43dace06bb441e46ca1882b51d2b9a71c5baa052ed42dbfe2c5965f01b50710
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d4f4f0bb41883a37b964850e9d6525e6c82bda7dc6b4eb7bef36193f41cd0a21
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF114F66B09E1681FB10EB29E9140A87378BF88FE4B444131CE1ED77A8EE3CE505C340
                                                                                                                                                                                                                              Function 00007FF611313048 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwprintf$fputwc
                                                                                                                                                                                                                              • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                              • API String ID: 2988249585-4054516066
                                                                                                                                                                                                                              • Opcode ID: 780129500cc8eb22b3af81c7775783de4b986a6307f7fb092a662ca78920ec8f
                                                                                                                                                                                                                              • Instruction ID: 5a1b3b433efee427e39deaa1f6d0b3c7f867a8ab0e4c29fdc5155cd4f06b77ef
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 780129500cc8eb22b3af81c7775783de4b986a6307f7fb092a662ca78920ec8f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E271DB76A08B49CADB50DF6AC8815A877F4F748FA8B018536EE4D87758DF38D510CB40
                                                                                                                                                                                                                              Function 00007FF611307D60 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$malloc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3157260142-0
                                                                                                                                                                                                                              • Opcode ID: bebafa3fc507f9c40b8e2e1084042dec21c5cd6be2e2a9f71abb3c5bc8a466b7
                                                                                                                                                                                                                              • Instruction ID: 9a546e083b5e079a15bde28031040c13c5b087ca8df6f7848820d4db3313fbbe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bebafa3fc507f9c40b8e2e1084042dec21c5cd6be2e2a9f71abb3c5bc8a466b7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63113C02B4ED9644FF5BAA9359116FA55D92F46FF4E0C4430ED4ECB78AFD2CA8428350
                                                                                                                                                                                                                              Function 00007FF611302AD0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1200242243-0
                                                                                                                                                                                                                              • Opcode ID: 57b41cf59eeebec43940bf3f5d915734346139c7fb041d6f7fac98ec8a71f233
                                                                                                                                                                                                                              • Instruction ID: 921dcbd2f04ac0dfe9e23e53c63de1a17d3a306dce3db26bb15bc6a74e4f117c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 57b41cf59eeebec43940bf3f5d915734346139c7fb041d6f7fac98ec8a71f233
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D018C31E1CD7642FB683B6A68852B921C9AF88FB1F554830D90AC5BDDDC6C68C29300
                                                                                                                                                                                                                              Function 00007FF61130E640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: CCG
                                                                                                                                                                                                                              • API String ID: 0-1584390748
                                                                                                                                                                                                                              • Opcode ID: 0e3aed78a1e4c150b1ff523e32ba85c0a188e2a4dfc2739e81b31b52371fb521
                                                                                                                                                                                                                              • Instruction ID: 0e4ecac4ac4ad5357a4eb92c74e36a837a43b8f1b0fbf910ca19f15380ff0b0e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e3aed78a1e4c150b1ff523e32ba85c0a188e2a4dfc2739e81b31b52371fb521
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9410F72F09E268AF7249B64D5443BC27E8AB45F78F104A35CA2DD77E8CE3CA6418251
                                                                                                                                                                                                                              Function 00007FF611302DC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF611302E28
                                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 00007FF611302E4B
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
                                                                                                                                                                                                                              • API String ID: 1878133881-785100509
                                                                                                                                                                                                                              • Opcode ID: 996ea42dbfbdc6150fb3e78afd1d99beba1d91d16d45c08ba1a9db144a0f4385
                                                                                                                                                                                                                              • Instruction ID: 331f44d4d53625b863712c2d933f9928b3f5198ed5dcff3cfd9be422d15525bd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 996ea42dbfbdc6150fb3e78afd1d99beba1d91d16d45c08ba1a9db144a0f4385
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2001D16371569005FB256622BD0ABFA05896B49FE1F888034EF4D97BC9EC3CD582C704
                                                                                                                                                                                                                              Function 00007FF6113045A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                              • API String ID: 1532159127-1977442011
                                                                                                                                                                                                                              • Opcode ID: a705923171a296baecb93f2081270a394e4d88c8d8c6dfbd024d0ef3db960c6d
                                                                                                                                                                                                                              • Instruction ID: ad38949581b534d2057e1c825f5c2f854a9ac41c18d49ac2ecdfa60e9268b5ab
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a705923171a296baecb93f2081270a394e4d88c8d8c6dfbd024d0ef3db960c6d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E1F04952B1CD1381FB68A725AC193B902EDAF08FE0F444435E80EC6ADEED1DEA468300
                                                                                                                                                                                                                              Function 00007FF6113051B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • calloc.MSVCRT ref: 00007FF6113051D1
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWidecalloc
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 2568606709-3944641314
                                                                                                                                                                                                                              • Opcode ID: 153298e754a5da29828527c7272e57dc28a8d1b5d2e4a766274f553e5afb193d
                                                                                                                                                                                                                              • Instruction ID: c2d88bec3e508551eee575b6aba525e77e25bd04edd0237e6571beeaa7f890a8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 153298e754a5da29828527c7272e57dc28a8d1b5d2e4a766274f553e5afb193d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BD219861B09E0986FB149B699D802B973A9BF45BB1F544335DE2DC23D8EE28E0108600
                                                                                                                                                                                                                              Function 00007FF611302CC0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                                              • API String ID: 3219091393-982972847
                                                                                                                                                                                                                              • Opcode ID: 9418ccf11d311c357f2c0b44d681edf2e8f7f8742d0759f808d0dfda2e738276
                                                                                                                                                                                                                              • Instruction ID: 36f04ec6f88cd3a2bc258049d2dc4832329a60f1c62f89f35d7fe934959795e2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9418ccf11d311c357f2c0b44d681edf2e8f7f8742d0759f808d0dfda2e738276
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E014F01B5A96905FE5965B629266BA51990F09FE0E489434ED0ECBB8AED1CE4024300
                                                                                                                                                                                                                              Function 00007FF61130DBC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-3474627141
                                                                                                                                                                                                                              • Opcode ID: 20dae29a08e59d28e827f7f7a2a2eda8259e4d1817ef6dbd98be60ed78e0c5d9
                                                                                                                                                                                                                              • Instruction ID: 83cd38c150c21dcc6a206d56e2a343aac2aaa16d0ed3991e54ce75f160be39ec
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20dae29a08e59d28e827f7f7a2a2eda8259e4d1817ef6dbd98be60ed78e0c5d9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83216F26A04FC48AD7118F68D8413EA7375FF59BA8F444622EE8C57768EF38D249C300
                                                                                                                                                                                                                              Function 00007FF611302FE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message_errno
                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                              • API String ID: 1796756983-2410924014
                                                                                                                                                                                                                              • Opcode ID: 89ab3f84670d69496295afaeef3f91396c60eac41d8d5ed9af97d336e694a63d
                                                                                                                                                                                                                              • Instruction ID: c28294c9a89b346d21826169c9b2e5bff147003e177ddd24247e852ee4af21bc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 89ab3f84670d69496295afaeef3f91396c60eac41d8d5ed9af97d336e694a63d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D01FF6261CA8191E324AB51F4007EA62A8FB98BE0F504135EB8D53B9D9E3CD656CB40
                                                                                                                                                                                                                              Function 00007FF61130DC40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4273532761
                                                                                                                                                                                                                              • Opcode ID: baefd7cba75bd780381bd2d5fed287ff04b74d7fa079984f5394eb8e5ce75d69
                                                                                                                                                                                                                              • Instruction ID: 614a5cfc97548770ad11d54b2da1bc4c32960a977976bb582593597519d62a9e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: baefd7cba75bd780381bd2d5fed287ff04b74d7fa079984f5394eb8e5ce75d69
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2187435201
                                                                                                                                                                                                                              • Opcode ID: 81b53d873045e560598026d8c864cfe1e58fa63b90fba301861682825eddf50a
                                                                                                                                                                                                                              • Instruction ID: 991929bb0221d0ccdbae86cc5719e2498dfa6eac88ff986c4a2e6d33164df791
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 81b53d873045e560598026d8c864cfe1e58fa63b90fba301861682825eddf50a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92015A26A04F888AD7118F69D8402AA7779FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2713391170
                                                                                                                                                                                                                              • Opcode ID: 06bf403f4c0a9af45a90ca5965f87b6ee5c3a6750db8dc5ebbd969be290419dd
                                                                                                                                                                                                                              • Instruction ID: 1a0d58422669a28d37bbbca04a876133b6798bdb7d21cda2d00c0aea62eeea42
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06bf403f4c0a9af45a90ca5965f87b6ee5c3a6750db8dc5ebbd969be290419dd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A7015E26904F888AD7118F69D8402AA7775FF4DBA8F044722EE8D27768DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2468659920
                                                                                                                                                                                                                              • Opcode ID: ec9f448085d72bf13c83586b7c52257c26f7af234c67fb9552149ff3dd26a3a7
                                                                                                                                                                                                                              • Instruction ID: ab7acd62de75aa1df805807dd5b92a3e5c17fc3ed1e501a2969a32f59a844363
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec9f448085d72bf13c83586b7c52257c26f7af234c67fb9552149ff3dd26a3a7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D67728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC26 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4064033741
                                                                                                                                                                                                                              • Opcode ID: fc72b1ca348bb75ea9640cba4845ceefab8200df23c4986763f386d421d396ac
                                                                                                                                                                                                                              • Instruction ID: cd6684805ad6265800390dd79e64661528e02356433dd864c571321267a38df1
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc72b1ca348bb75ea9640cba4845ceefab8200df23c4986763f386d421d396ac
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4283191376
                                                                                                                                                                                                                              • Opcode ID: 1dadd9d91598fd59cd3ee44cef548247d0e8863d0b21ccbc5bbcccc010ffab5c
                                                                                                                                                                                                                              • Instruction ID: d2e26451fd359e7ea30e872cf20c2c22af6540c0d195cb8b107f978fdfae3719
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dadd9d91598fd59cd3ee44cef548247d0e8863d0b21ccbc5bbcccc010ffab5c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D015A26A04F888AD7118F69D8402AA7779FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF611304960 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1294909896-0
                                                                                                                                                                                                                              • Opcode ID: 9c4186f722e86582c3b1398c543642522ac53436e10a90fe38125ad0e5a34d3b
                                                                                                                                                                                                                              • Instruction ID: 135b8bc12ab8c9e5dc827b3fb08364c05a0372c10145f2bdbcdaa445df2b548c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9c4186f722e86582c3b1398c543642522ac53436e10a90fe38125ad0e5a34d3b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D6017127E4991982EB509B6AB4412BD32B9FF88F64F155231DE0DC734ADD28D882C780
                                                                                                                                                                                                                              Function 00007FF611307060 Relevance: 5.0, APIs: 4, Instructions: 26COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000000.00000002.2282660716.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282640609.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282683963.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282702280.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282723530.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282742073.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282759912.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000000.00000002.2282777400.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1294909896-0
                                                                                                                                                                                                                              • Opcode ID: 17bb4e15e412b02df2bc7990f2a8c6dca0a60341a4ea025c79cb532fcc6a30aa
                                                                                                                                                                                                                              • Instruction ID: 840a8d54c22161b11d819af650f246fbc9d32983dc32b8c8661f910423b2f066
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17bb4e15e412b02df2bc7990f2a8c6dca0a60341a4ea025c79cb532fcc6a30aa
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0FF0EC19F4BD0A41FF1AE6A1B4103FD62685F44F60F044130CF8DDB6499E2CA4438300

                                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                                              Execution Coverage:1.5%
                                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                                              Total number of Nodes:1259
                                                                                                                                                                                                                              Total number of Limit Nodes:16
                                                                                                                                                                                                                              execution_graph 55011 7ff6113037e0 55012 7ff6113037f6 55011->55012 55013 7ff611303a51 55012->55013 55014 7ff61130381c 55012->55014 55072 7ff611302e60 10 API calls 55013->55072 55016 7ff611303a5d 55014->55016 55023 7ff611303834 55014->55023 55073 7ff611302e60 10 API calls 55016->55073 55020 7ff611303946 55068 7ff611302e60 10 API calls 55020->55068 55022 7ff611303ba8 55023->55020 55024 7ff611303959 55023->55024 55026 7ff611303930 55023->55026 55027 7ff611303921 free 55023->55027 55029 7ff611303973 55023->55029 55039 7ff611301b30 55023->55039 55065 7ff611303240 55023->55065 55069 7ff611302e60 10 API calls 55024->55069 55027->55023 55028 7ff611303a6e 55028->55022 55033 7ff611303b9d _strdup 55028->55033 55030 7ff6113039cb _strdup 55029->55030 55031 7ff6113039d6 55029->55031 55030->55031 55070 7ff611302240 strlen strncmp 55031->55070 55033->55022 55034 7ff6113039f1 55034->55028 55035 7ff6113039f9 _strdup 55034->55035 55036 7ff611303a20 55035->55036 55071 7ff611302cc0 28 API calls 55036->55071 55038 7ff611303a37 free free 55038->55026 55074 7ff611304650 55039->55074 55041 7ff611301b52 55042 7ff611301c60 55041->55042 55043 7ff611301b5e 55041->55043 55109 7ff611302e60 10 API calls 55042->55109 55080 7ff611310020 55043->55080 55046 7ff611301c08 55046->55023 55048 7ff611301c40 55108 7ff611302fe0 11 API calls 55048->55108 55049 7ff611301b78 malloc 55051 7ff611301b91 55049->55051 55052 7ff611301c76 55049->55052 55053 7ff611301c20 55051->55053 55054 7ff611301b9d 55051->55054 55110 7ff611302fe0 11 API calls 55052->55110 55083 7ff611301710 55053->55083 55056 7ff611301ba5 55054->55056 55057 7ff611301bb8 fread 55054->55057 55059 7ff611301c00 fclose 55056->55059 55060 7ff611301bb0 55057->55060 55061 7ff611301bdd 55057->55061 55059->55046 55060->55057 55060->55059 55107 7ff611302fe0 11 API calls 55061->55107 55062 7ff611301c31 55062->55059 55064 7ff611301bf5 free 55062->55064 55064->55056 55142 7ff6113101e0 55065->55142 55068->55026 55069->55026 55070->55034 55071->55038 55072->55016 55073->55028 55075 7ff61130465d 55074->55075 55111 7ff611309090 55075->55111 55078 7ff611309090 10 API calls 55079 7ff61130468f _wfopen 55078->55079 55079->55041 55127 7ff611310060 55080->55127 55133 7ff61130a920 55083->55133 55085 7ff611301779 55086 7ff611301783 malloc 55085->55086 55087 7ff611301a58 55085->55087 55088 7ff611301799 malloc 55086->55088 55089 7ff611301aaf 55086->55089 55139 7ff611302e60 10 API calls 55087->55139 55092 7ff6113017af 55088->55092 55093 7ff611301a98 55088->55093 55141 7ff611302fe0 11 API calls 55089->55141 55095 7ff6113017d5 fread 55092->55095 55140 7ff611302fe0 11 API calls 55093->55140 55094 7ff61130180d 55094->55095 55097 7ff611301854 55094->55097 55100 7ff611301ad0 55094->55100 55103 7ff6113018e7 fwrite 55094->55103 55137 7ff61130a9d0 memcpy memcpy memcpy 55094->55137 55095->55097 55098 7ff6113017fd ferror 55095->55098 55102 7ff611301892 55097->55102 55138 7ff611302e60 10 API calls 55097->55138 55098->55094 55098->55097 55104 7ff61130189f free free 55102->55104 55103->55097 55105 7ff61130190f ferror 55103->55105 55104->55062 55105->55097 55106 7ff611301924 55105->55106 55106->55094 55107->55064 55108->55056 55109->55046 55110->55056 55112 7ff6113090e0 MultiByteToWideChar 55111->55112 55113 7ff6113090a3 55111->55113 55115 7ff611309168 55112->55115 55116 7ff611309115 calloc 55112->55116 55114 7ff6113090ad MultiByteToWideChar 55113->55114 55118 7ff611309148 55114->55118 55119 7ff61130467e 55114->55119 55126 7ff611302f40 10 API calls 55115->55126 55116->55114 55120 7ff61130912b 55116->55120 55125 7ff611302f40 10 API calls 55118->55125 55119->55078 55124 7ff611302f40 10 API calls 55120->55124 55123 7ff611309140 55123->55119 55124->55123 55125->55119 55126->55119 55128 7ff6113100a6 55127->55128 55129 7ff61131007a 55127->55129 55128->55129 55130 7ff6113100e8 _errno 55128->55130 55131 7ff6113100fa fsetpos 55129->55131 55132 7ff611301b70 55129->55132 55130->55132 55131->55132 55132->55048 55132->55049 55134 7ff61130a830 55133->55134 55135 7ff61130a87e malloc 55134->55135 55136 7ff61130a893 55134->55136 55135->55136 55136->55085 55137->55094 55138->55102 55139->55094 55140->55089 55141->55089 55143 7ff61131022b 55142->55143 55144 7ff611310202 55142->55144 55149 7ff6113122d2 fputc 55143->55149 55148 7ff6113122d2 fputc 55144->55148 55147 7ff61130325d 55147->55023 55148->55147 55149->55147 55150 7ffd930b3a8a 55152 7ffd93245d80 55150->55152 55151 7ffd93245e94 55152->55151 55154 7ffd930b2b53 55152->55154 55154->55151 55155 7ffd932a91b0 55154->55155 55156 7ffd932a91ba TlsFree 55155->55156 55156->55151 55157 655c6580 PySys_GetObject 55158 655c65af PyTuple_GetItem 55157->55158 55159 655c6be6 55157->55159 55158->55159 55160 655c65c6 PyLong_AsLong PyTuple_GetItem 55158->55160 55160->55159 55161 655c65eb PyLong_AsLong PySys_GetObject 55160->55161 55162 655c6606 PyLong_AsVoidPtr 55161->55162 55163 655c6612 GetProcAddress GetProcAddress GetProcAddress PyModule_Create2 55161->55163 55162->55163 55163->55159 55164 655c66a6 PyModule_GetName 55163->55164 55164->55159 55165 655c66bb strrchr 55164->55165 55166 655c670f 55165->55166 55167 655c66d8 malloc 55165->55167 55169 655c6e10 55166->55169 55170 655c672e 55166->55170 55167->55166 55168 655c66f2 memcpy 55167->55168 55168->55166 55173 655c7577 exit 55169->55173 55185 655c6a3c 55169->55185 55351 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55169->55351 55171 655c72b9 55170->55171 55172 655c6743 PyBytes_FromStringAndSize 55170->55172 55175 655c72c9 55171->55175 55176 655c73f7 55171->55176 55174 655c6761 PyBytes_AsString 55172->55174 55242 655c6be0 55172->55242 55180 655c677a malloc 55174->55180 55181 655c6c00 55174->55181 55175->55173 55354 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55175->55354 55355 655c1660 13 API calls 55176->55355 55178 655c6e40 55183 655c6e4c PyErr_Format 55178->55183 55178->55185 55179 655c6c16 _Py_Dealloc 55179->55159 55180->55181 55186 655c6791 PyCMethod_New 55180->55186 55191 655c6c0a _Py_Dealloc 55181->55191 55181->55242 55193 655c6e80 55183->55193 55187 655c72e9 PyErr_Format 55185->55187 55195 655c7294 55185->55195 55201 655c753d 55185->55201 55243 655c6a57 55185->55243 55189 655c67d9 PyCMethod_New 55186->55189 55190 655c6c21 55186->55190 55205 655c731f 55187->55205 55188 655c6a74 55188->55176 55194 655c6a7c 55188->55194 55189->55190 55196 655c681f PyCMethod_New 55189->55196 55197 655c6c2f 55190->55197 55198 655c6d60 _Py_Dealloc 55190->55198 55191->55159 55191->55179 55206 655c6e9b PyBytes_AsStringAndSize 55193->55206 55193->55242 55345 655df8c0 31 API calls 55194->55345 55196->55190 55202 655c6865 PyBytes_FromStringAndSize 55196->55202 55197->55181 55198->55185 55363 655c1660 13 API calls 55201->55363 55204 655c6896 PyBytes_AsString 55202->55204 55202->55242 55203 655c6ac7 55207 655c6acf 55203->55207 55208 655c7505 55203->55208 55209 655d3c90 55204->55209 55210 655c7330 55205->55210 55211 655c7472 55205->55211 55212 655c6eb7 55206->55212 55206->55242 55214 655c6adb 55207->55214 55215 655c74e7 55207->55215 55362 655c1660 13 API calls 55208->55362 55216 655c6974 _time64 srand 55209->55216 55210->55173 55219 655c7343 55210->55219 55358 655c80a0 8 API calls 55211->55358 55240 655c6ef5 55212->55240 55247 655c6f12 55212->55247 55220 655c6c35 malloc 55214->55220 55222 655c6b19 strstr 55214->55222 55223 655c6b74 55214->55223 55361 655c1660 13 API calls 55215->55361 55339 655dd660 __iob_func abort 55216->55339 55246 655c7363 PyErr_Format 55219->55246 55224 655c7529 _errno 55220->55224 55225 655c6c50 55220->55225 55222->55223 55229 655c6b35 55222->55229 55232 655c6b85 55223->55232 55233 655c7520 55223->55233 55230 655c7440 55224->55230 55347 655c7d50 memcpy strlen memcpy __iob_func abort 55225->55347 55226 655c69ae 55226->55205 55340 655ddad0 10 API calls 55226->55340 55227 655c6f39 memcpy 55227->55185 55239 655c6f4f _Py_Dealloc 55227->55239 55229->55223 55241 655c6b50 strncmp 55229->55241 55356 655c7fa0 8 API calls 55230->55356 55232->55173 55235 655c6b9c 55232->55235 55233->55224 55346 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55235->55346 55236 655c6c73 55348 6563ea40 __iob_func abort 55236->55348 55239->55185 55352 655c80a0 8 API calls 55240->55352 55241->55220 55241->55223 55242->55159 55242->55179 55243->55195 55243->55242 55293 655df060 55243->55293 55245 655c744a _errno 55245->55242 55246->55242 55247->55211 55247->55227 55249 655c69c3 55249->55205 55341 655dd840 10 API calls 55249->55341 55250 655c6c8f 55252 655c7457 55250->55252 55253 655c6c97 55250->55253 55251 655c6ba9 55254 655c749c 55251->55254 55255 655c6bb5 PyErr_Format 55251->55255 55357 655c1660 13 API calls 55252->55357 55258 655c6ca9 malloc 55253->55258 55259 655c6ca4 free 55253->55259 55264 655c74ab 55254->55264 55255->55242 55262 655c6cc6 memcpy 55258->55262 55263 655c7431 _errno 55258->55263 55259->55258 55260 655c69d8 55260->55205 55342 655dd270 10 API calls 55260->55342 55261 655c6d3e 55261->55242 55292 655c6d46 55261->55292 55265 655c6ce7 55262->55265 55266 655c6f80 55262->55266 55263->55230 55359 655c1660 13 API calls 55264->55359 55269 655c6ced 55265->55269 55270 655c6da0 55265->55270 55266->55173 55288 655c7383 55266->55288 55353 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55266->55353 55274 655c6d07 malloc 55269->55274 55275 655c6d02 free 55269->55275 55284 655c6d36 55269->55284 55270->55173 55270->55288 55350 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55270->55350 55271 655c69ed 55272 655c74c9 55271->55272 55273 655c69fb 55271->55273 55360 655c1660 13 API calls 55272->55360 55343 655dd510 10 API calls 55273->55343 55281 655c6d24 memcpy 55274->55281 55282 655c7563 _errno 55274->55282 55275->55274 55280 655c6a07 55280->55264 55344 655dd3c0 10 API calls 55280->55344 55281->55284 55282->55230 55283 655c6fb1 55286 655c6fbd PyErr_Format 55283->55286 55283->55288 55284->55261 55349 655c4050 exit 55284->55349 55285 655c6dd1 55287 655c6ddd PyErr_Format 55285->55287 55285->55288 55286->55242 55287->55242 55288->55187 55291 655c6a21 55291->55185 55291->55193 55291->55201 55292->55159 55294 655df4dc 55293->55294 55295 655df080 55293->55295 55297 655dd200 2 API calls 55294->55297 55296 655df4c3 55295->55296 55298 655df09b 55295->55298 55299 655df4aa 55295->55299 55300 655dd200 2 API calls 55296->55300 55301 655df4f5 55297->55301 55364 655e0d10 55298->55364 55373 655dd200 __iob_func 55299->55373 55300->55294 55304 655df6e5 55301->55304 55307 655df53d 55301->55307 55308 655df6cc 55301->55308 55306 655dd200 2 API calls 55304->55306 55312 655df6fe 55306->55312 55307->55312 55317 655df546 55307->55317 55311 655dd200 2 API calls 55308->55311 55309 655df0f5 calloc 55313 655df114 55309->55313 55323 655df1f8 55309->55323 55310 655df0e3 55310->55188 55311->55304 55314 655dd200 2 API calls 55312->55314 55368 655e1dc0 6 API calls 55313->55368 55330 655df626 55314->55330 55315 655df550 55315->55188 55317->55315 55324 655e0d10 24 API calls 55317->55324 55318 655df14a 55319 655df14e 55318->55319 55320 655df1c0 55318->55320 55369 655e1c50 __iob_func abort calloc free 55319->55369 55370 655e1c50 __iob_func abort calloc free 55320->55370 55327 655df420 55323->55327 55328 655df2b3 55323->55328 55334 655df1a4 55323->55334 55325 655df5a2 55324->55325 55325->55315 55325->55330 55337 655df5b8 55325->55337 55326 655df1ae free 55326->55310 55327->55334 55372 655e1c50 __iob_func abort calloc free 55327->55372 55328->55334 55371 655e1c50 __iob_func abort calloc free 55328->55371 55329 655e0d10 24 API calls 55329->55330 55330->55329 55336 655df6b1 55330->55336 55378 655e44c0 __iob_func abort 55330->55378 55334->55326 55336->55330 55377 655e0fe0 __iob_func abort calloc free free 55336->55377 55337->55330 55337->55336 55376 655e0fe0 __iob_func abort calloc free free 55337->55376 55339->55226 55340->55249 55341->55260 55342->55271 55343->55280 55344->55291 55345->55203 55346->55251 55347->55236 55348->55250 55350->55285 55351->55178 55352->55242 55353->55283 55354->55187 55355->55242 55356->55245 55357->55261 55358->55242 55359->55242 55360->55261 55361->55261 55362->55261 55363->55242 55365 655e0d47 55364->55365 55366 655df0dd 55364->55366 55365->55366 55379 655dbf20 55365->55379 55366->55309 55366->55310 55368->55318 55369->55334 55370->55323 55371->55334 55372->55334 55374 65640fd0 55373->55374 55375 655dd231 abort 55374->55375 55376->55337 55377->55336 55378->55330 55380 655dbf29 55379->55380 55381 655dbf34 55379->55381 55380->55365 55382 655dd200 2 API calls 55381->55382 55383 655dbf4d 55382->55383 55384 655dbf59 55383->55384 55385 655dd200 2 API calls 55383->55385 55384->55365 55386 655dbf91 55385->55386 55387 655dbfa9 55386->55387 55388 655dd200 2 API calls 55386->55388 55387->55365 55389 655dbfe0 55388->55389 55390 655dbff9 55389->55390 55391 655dc005 55389->55391 55688 655ec4c0 memset memset rand memset 55390->55688 55393 655dd200 2 API calls 55391->55393 55398 655dc01e 55393->55398 55394 655dbffe 55394->55365 55395 655dc0b2 55397 655dd200 2 API calls 55395->55397 55396 655dc099 55400 655dd200 2 API calls 55396->55400 55411 655dc0cb 55397->55411 55398->55395 55398->55396 55399 655dc080 55398->55399 55401 655dc03c 55398->55401 55402 655dc067 55398->55402 55404 655dd200 2 API calls 55399->55404 55400->55395 55689 655e7e40 9 API calls 55401->55689 55408 655dd200 2 API calls 55402->55408 55403 655dc162 55407 655dd200 2 API calls 55403->55407 55404->55396 55406 655dc149 55409 655dd200 2 API calls 55406->55409 55413 655dc17b 55407->55413 55408->55399 55409->55403 55410 655dc041 55410->55365 55411->55403 55411->55406 55412 655dc130 55411->55412 55414 655dc0ec 55411->55414 55415 655dc117 55411->55415 55417 655dd200 2 API calls 55412->55417 55416 655dc18b 55413->55416 55420 655dd200 2 API calls 55413->55420 55690 655e7a50 9 API calls 55414->55690 55421 655dd200 2 API calls 55415->55421 55419 655dc190 55416->55419 55423 655dd200 2 API calls 55416->55423 55417->55406 55419->55365 55420->55416 55421->55412 55422 655dc0f1 55422->55365 55424 655dc203 55423->55424 55425 655dc442 55424->55425 55428 655dd200 2 API calls 55424->55428 55437 655dc228 55424->55437 55426 655dd200 2 API calls 55425->55426 55427 655dc45b 55426->55427 55429 655dc469 55427->55429 55431 655dd200 2 API calls 55427->55431 55428->55425 55430 655dc46e 55429->55430 55432 655dd200 2 API calls 55429->55432 55430->55365 55431->55429 55433 655dc4ac 55432->55433 55434 655dc4b9 55433->55434 55435 655dc4d2 55433->55435 55438 655dc504 55434->55438 55439 655dc4eb 55434->55439 55441 655dc4c3 55434->55441 55436 655dd200 2 API calls 55435->55436 55436->55439 55437->55365 55440 655dd200 2 API calls 55438->55440 55442 655dd200 2 API calls 55439->55442 55443 655dc51d 55440->55443 55691 655ec7b0 memset memcpy memset memset 55441->55691 55442->55438 55446 655dc529 55443->55446 55448 655dd200 2 API calls 55443->55448 55445 655dc4cb 55445->55365 55447 655dc571 55446->55447 55450 655dc533 55446->55450 55451 655dd200 2 API calls 55446->55451 55449 655dd200 2 API calls 55447->55449 55448->55446 55452 655dc58a 55449->55452 55450->55365 55451->55447 55453 655dc5af 55452->55453 55454 655dc599 55452->55454 55456 655dd200 2 API calls 55453->55456 55455 655dc5e1 55454->55455 55457 655dc5c8 55454->55457 55458 655dc5a3 55454->55458 55459 655dd200 2 API calls 55455->55459 55456->55457 55461 655dd200 2 API calls 55457->55461 55692 655e7990 memset memset 55458->55692 55462 655dc5fa 55459->55462 55461->55455 55463 655dc609 55462->55463 55465 655dd200 2 API calls 55462->55465 55466 655dd200 2 API calls 55463->55466 55468 655dc60e 55463->55468 55464 655dc5a8 55464->55365 55465->55463 55467 655dc65e 55466->55467 55469 655dc67f 55467->55469 55470 655dc669 55467->55470 55468->55365 55471 655dd200 2 API calls 55469->55471 55472 655dc6b1 55470->55472 55473 655dc698 55470->55473 55475 655dc673 55470->55475 55471->55473 55474 655dd200 2 API calls 55472->55474 55476 655dd200 2 API calls 55473->55476 55477 655dc6ca 55474->55477 55693 655e7d80 memset memset 55475->55693 55476->55472 55480 655dd200 2 API calls 55477->55480 55482 655dc6d9 55477->55482 55479 655dc678 55479->55365 55481 655dc710 55480->55481 55483 655dc729 55481->55483 55484 655dc73a 55481->55484 55482->55365 55485 655dc72e 55483->55485 55486 655dc753 55483->55486 55487 655dd200 2 API calls 55484->55487 55694 655e92d0 memset 55485->55694 55489 655dd200 2 API calls 55486->55489 55487->55486 55491 655dc76c 55489->55491 55490 655dc733 55490->55365 55492 655dc77d 55491->55492 55493 655dc7a4 55491->55493 55494 655dc7bd 55492->55494 55495 655dc782 55492->55495 55496 655dd200 2 API calls 55493->55496 55498 655dd200 2 API calls 55494->55498 55695 656098e0 16 API calls 55495->55695 55496->55494 55504 655dc7d6 55498->55504 55499 655dc791 55499->55365 55500 655dc872 55502 655dd200 2 API calls 55500->55502 55501 655dc859 55503 655dd200 2 API calls 55501->55503 55506 655dc88b 55502->55506 55503->55500 55504->55500 55504->55501 55505 655dc840 55504->55505 55507 655dc7fc 55504->55507 55508 655dc827 55504->55508 55509 655dd200 2 API calls 55505->55509 55511 655dd200 2 API calls 55506->55511 55696 655ec430 16 API calls 55507->55696 55512 655dd200 2 API calls 55508->55512 55509->55501 55514 655dc8bb 55511->55514 55512->55505 55513 655dc801 55513->55365 55515 655dc8c9 55514->55515 55516 655dc8da 55514->55516 55517 655dc8ce 55515->55517 55518 655dc8f3 55515->55518 55519 655dd200 2 API calls 55516->55519 55697 655ec5b0 memset memset 55517->55697 55520 655dd200 2 API calls 55518->55520 55519->55518 55522 655dc90c 55520->55522 55524 655dc91d calloc 55522->55524 55525 655dc93e 55522->55525 55523 655dc8d3 55523->55365 55524->55365 55526 655dd200 2 API calls 55525->55526 55527 655dc957 55526->55527 55528 655dc9f0 55527->55528 55530 655dc9d7 55527->55530 55531 655dc977 calloc 55527->55531 55529 655dd200 2 API calls 55528->55529 55533 655dca09 55529->55533 55532 655dd200 2 API calls 55530->55532 55534 655dc9c1 55531->55534 55542 655dc993 55531->55542 55532->55528 55535 655dca89 55533->55535 55537 655dca70 55533->55537 55540 655dca57 55533->55540 55541 655dca23 55533->55541 55534->55365 55536 655dd200 2 API calls 55535->55536 55539 655dcaa2 55536->55539 55538 655dd200 2 API calls 55537->55538 55538->55535 55543 655dcb29 55539->55543 55548 655dcb10 55539->55548 55551 655dcaf7 55539->55551 55552 655dcac3 55539->55552 55545 655dd200 2 API calls 55540->55545 55698 65609250 10 API calls 55541->55698 55542->55534 55546 655dc9b9 free 55542->55546 55547 655dd200 2 API calls 55543->55547 55545->55537 55546->55534 55560 655dcb42 55547->55560 55550 655dd200 2 API calls 55548->55550 55549 655dca28 55549->55365 55550->55543 55555 655dd200 2 API calls 55551->55555 55699 6561a640 9 API calls 55552->55699 55553 655dcbe2 55557 655dd200 2 API calls 55553->55557 55555->55548 55556 655dcbc9 55559 655dd200 2 API calls 55556->55559 55562 655dcbfb 55557->55562 55558 655dcac8 55558->55365 55559->55553 55560->55553 55560->55556 55561 655dcbb0 55560->55561 55564 655dcb6c 55560->55564 55565 655dcb97 55560->55565 55563 655dd200 2 API calls 55561->55563 55566 655dcc1f 55562->55566 55567 655dcc09 55562->55567 55563->55556 55700 65609000 9 API calls 55564->55700 55568 655dd200 2 API calls 55565->55568 55571 655dd200 2 API calls 55566->55571 55570 655dcc51 55567->55570 55574 655dcc38 55567->55574 55575 655dcc13 55567->55575 55568->55561 55572 655dd200 2 API calls 55570->55572 55571->55574 55577 655dcc6a 55572->55577 55573 655dcb71 55573->55365 55576 655dd200 2 API calls 55574->55576 55701 65609bd0 9 API calls 55575->55701 55576->55570 55579 655dcc8f 55577->55579 55580 655dcc79 55577->55580 55583 655dd200 2 API calls 55579->55583 55582 655dccc1 55580->55582 55584 655dcca8 55580->55584 55585 655dcc83 55580->55585 55581 655dcc18 55581->55365 55586 655dd200 2 API calls 55582->55586 55583->55584 55588 655dd200 2 API calls 55584->55588 55702 65609050 9 API calls 55585->55702 55589 655dccda 55586->55589 55588->55582 55590 655dcd50 55589->55590 55593 655dd200 2 API calls 55589->55593 55600 655dccf2 55589->55600 55592 655dd200 2 API calls 55590->55592 55591 655dcc88 55591->55365 55594 655dcd69 55592->55594 55593->55590 55595 655dcdc1 55594->55595 55597 655dcd7e 55594->55597 55598 655dcda8 55594->55598 55596 655dd200 2 API calls 55595->55596 55602 655dcdda 55596->55602 55703 655ea430 9 API calls 55597->55703 55601 655dd200 2 API calls 55598->55601 55600->55365 55601->55595 55604 655dcde9 55602->55604 55605 655dcdfa 55602->55605 55603 655dcd83 55603->55365 55607 655dcdee 55604->55607 55608 655dce13 55604->55608 55606 655dd200 2 API calls 55605->55606 55606->55608 55704 65608bb0 memset 55607->55704 55609 655dd200 2 API calls 55608->55609 55611 655dce2c 55609->55611 55613 655dce39 55611->55613 55614 655dce4a 55611->55614 55612 655dcdf3 55612->55365 55615 655dce3e 55613->55615 55616 655dce63 55613->55616 55617 655dd200 2 API calls 55614->55617 55705 655e7e00 memset memset 55615->55705 55619 655dd200 2 API calls 55616->55619 55617->55616 55621 655dce7c 55619->55621 55620 655dce43 55620->55365 55622 655dce89 55621->55622 55623 655dce9a 55621->55623 55625 655dce8e 55622->55625 55626 655dceb3 55622->55626 55624 655dd200 2 API calls 55623->55624 55624->55626 55706 655e7a10 memset memset 55625->55706 55627 655dd200 2 API calls 55626->55627 55630 655dcecc 55627->55630 55629 655dce93 55629->55365 55631 655dced9 55630->55631 55632 655dceea 55630->55632 55633 655dcede 55631->55633 55634 655dcf03 55631->55634 55635 655dd200 2 API calls 55632->55635 55707 655e8940 memset 55633->55707 55637 655dd200 2 API calls 55634->55637 55635->55634 55639 655dcf1c 55637->55639 55638 655dcee3 55638->55365 55640 655dcf29 55639->55640 55641 655dcf3a 55639->55641 55642 655dcf2e 55640->55642 55643 655dcf53 55640->55643 55644 655dd200 2 API calls 55641->55644 55708 655e9020 memset memset 55642->55708 55646 655dd200 2 API calls 55643->55646 55644->55643 55648 655dcf6c 55646->55648 55647 655dcf33 55647->55365 55649 655dd200 2 API calls 55648->55649 55651 655dcf79 55648->55651 55650 655dcf9b 55649->55650 55652 655dcff1 55650->55652 55654 655dcfae 55650->55654 55655 655dcfd8 55650->55655 55651->55365 55653 655dd200 2 API calls 55652->55653 55657 655dd00a 55653->55657 55709 655e8cf0 memset memset 55654->55709 55656 655dd200 2 API calls 55655->55656 55656->55652 55659 655dd061 55657->55659 55662 655dd01e 55657->55662 55663 655dd048 55657->55663 55661 655dd200 2 API calls 55659->55661 55660 655dcfb3 55660->55365 55665 655dd07a 55661->55665 55710 655e87b0 memset memset toupper memset 55662->55710 55664 655dd200 2 API calls 55663->55664 55664->55659 55667 655dd089 55665->55667 55669 655dd200 2 API calls 55665->55669 55667->55365 55668 655dd023 55668->55365 55670 655dd0ae 55669->55670 55671 655dd200 2 API calls 55670->55671 55678 655dd0b9 55670->55678 55672 655dd0db 55671->55672 55673 655dd200 2 API calls 55672->55673 55675 655dd0e9 55672->55675 55674 655dd10b 55673->55674 55676 655dd119 55674->55676 55677 655dd200 2 API calls 55674->55677 55675->55365 55676->55365 55679 655dd13e 55677->55679 55678->55365 55680 655dd19d 55679->55680 55681 655dd152 calloc 55679->55681 55682 655dd200 2 API calls 55680->55682 55683 655dd16c 55681->55683 55684 655dd190 55681->55684 55685 655dd1b6 55682->55685 55683->55685 55686 655dd171 55683->55686 55684->55365 55687 655dd200 2 API calls 55685->55687 55686->55365 55687->55651 55688->55394 55689->55410 55690->55422 55691->55445 55692->55464 55693->55479 55694->55490 55695->55499 55696->55513 55697->55523 55698->55549 55699->55558 55700->55573 55701->55581 55702->55591 55703->55603 55704->55612 55705->55620 55706->55629 55707->55638 55708->55647 55709->55660 55710->55668 55711 655c5881 55712 655c5e79 55711->55712 55713 655c5880 55711->55713 55715 655c60b1 55712->55715 55716 655c636c exit 55712->55716 55834 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55712->55834 55713->55711 55714 655c589b 55713->55714 55717 655c58c9 55714->55717 55718 655c58a1 55714->55718 55715->55716 55719 655c6394 55716->55719 55766 655c64a5 55716->55766 55728 655c62f7 55717->55728 55772 655c7590 55717->55772 55833 655cfda0 VirtualAlloc memcpy fwrite 55718->55833 55723 655c63a4 55719->55723 55837 655cfec0 VirtualFree 55719->55837 55727 655c63cc 55723->55727 55734 655c63bc free 55723->55734 55724 655c5ea8 55724->55715 55729 655c5eb4 PyErr_Format 55724->55729 55726 655c54d0 55741 655c54f1 PyUnicode_FromFormat 55726->55741 55749 655c5562 55726->55749 55739 655c63dd free 55727->55739 55740 655c63e2 55727->55740 55836 655c80a0 8 API calls 55728->55836 55729->55715 55731 655c5903 55733 655c5918 PyUnicode_AsUTF8 55731->55733 55736 655c6199 55731->55736 55737 655c593e 55733->55737 55738 655c5958 PyImport_GetModuleDict PyDict_GetItem 55733->55738 55734->55723 55734->55727 55735 655c5ad4 PyEval_GetFrame 55735->55731 55736->55716 55736->55728 55747 655c61bb 55736->55747 55737->55738 55742 655c599d PyImport_ExecCodeModuleObject PyErr_Occurred 55737->55742 55738->55742 55743 655c5974 PyModule_GetDict PyDict_GetItemString 55738->55743 55739->55740 55744 655c63ee free 55740->55744 55745 655c63f3 55740->55745 55746 655c550a Py_DecRef 55741->55746 55741->55749 55742->55726 55742->55749 55743->55742 55748 655c60e5 PyEval_EvalCode 55743->55748 55744->55745 55750 655c63ff free 55745->55750 55751 655c6404 55745->55751 55746->55749 55835 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55747->55835 55752 655c60fd Py_DecRef Py_IncRef 55748->55752 55753 655c551b 55748->55753 55750->55751 55755 655c640d free 55751->55755 55756 655c6412 55751->55756 55752->55749 55753->55749 55763 655c553c PyUnicode_FromFormat 55753->55763 55755->55756 55757 655c6428 55756->55757 55759 655c64e2 _Py_Dealloc 55756->55759 55760 655c643b 55757->55760 55762 655c6500 _Py_Dealloc 55757->55762 55758 655c61c8 55758->55728 55761 655c61d4 PyErr_Format 55758->55761 55759->55757 55759->55760 55765 655c6520 _Py_Dealloc 55760->55765 55770 655c6451 55760->55770 55761->55726 55762->55760 55762->55770 55763->55749 55764 655c5555 Py_DecRef 55763->55764 55764->55749 55765->55766 55765->55770 55767 655c6550 _Py_Dealloc 55767->55770 55768 655c6570 _Py_Dealloc 55768->55770 55769 655c6560 _Py_Dealloc 55769->55770 55770->55766 55770->55767 55770->55768 55770->55769 55771 655c6540 _Py_Dealloc 55770->55771 55771->55767 55773 655c75ba 55772->55773 55774 655c7880 55772->55774 55776 655c75c3 55773->55776 55787 655c7896 55773->55787 55911 6563eb00 __iob_func abort 55774->55911 55777 655c79c0 55776->55777 55783 655c75d9 55776->55783 55778 655c7d42 exit 55777->55778 55779 655c7c04 55777->55779 55915 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55777->55915 55802 655c7b55 PyErr_Format 55779->55802 55781 655c7cd2 55789 655c7cf0 free 55781->55789 55782 655c764d 55785 655c765c 55782->55785 55786 655c7a40 55782->55786 55783->55782 55788 655c75fb malloc 55783->55788 55790 655c7b80 55783->55790 55909 655ce6e0 21 API calls 55785->55909 55786->55790 55794 655c7a50 55786->55794 55787->55777 55787->55778 55787->55781 55787->55790 55791 655c793b PyErr_Format 55787->55791 55805 655c78d3 PyErr_Format 55787->55805 55824 655c7767 55787->55824 55912 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55787->55912 55913 6563eb60 __iob_func abort 55787->55913 55914 6563ee30 __iob_func abort 55787->55914 55795 655c7cf8 PyErr_NoMemory 55788->55795 55796 655c7611 55788->55796 55789->55795 55790->55778 55800 655c7bc2 55790->55800 55791->55787 55792 655c79ff 55792->55779 55801 655c7a0b PyErr_Format 55792->55801 55794->55778 55916 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55794->55916 55799 655c58eb 55795->55799 55796->55789 55806 655c7623 55796->55806 55797 655c7675 55797->55799 55807 655c7862 memset 55797->55807 55817 655c7689 55797->55817 55799->55726 55799->55731 55799->55735 55918 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55800->55918 55801->55786 55802->55799 55805->55787 55838 655d3ce0 55806->55838 55807->55817 55830 655c7691 55807->55830 55808 655c7bcf PyErr_Format 55808->55799 55809 655c7a6f 55809->55779 55812 655c7a7b PyErr_Format 55809->55812 55812->55824 55815 655c7c6e 55815->55778 55825 655c7c90 55815->55825 55816 655c77e6 55910 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55816->55910 55819 655c7b10 55817->55819 55817->55830 55820 655c7c40 55819->55820 55821 655c7b20 55819->55821 55820->55808 55821->55778 55826 655c7b32 55821->55826 55822 655c77f3 55827 655c77ff PyErr_Format 55822->55827 55832 655c7c9d PyErr_Format 55822->55832 55824->55778 55824->55799 55824->55816 55824->55832 55919 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55825->55919 55917 655c13c0 PySys_GetObject PyUnicode_AsUTF8AndSize getenv PySys_GetObject PyErr_Clear 55826->55917 55827->55799 55830->55799 55830->55824 55831 655c7b3f 55831->55779 55831->55802 55832->55799 55833->55717 55834->55724 55835->55758 55836->55726 55920 65620d20 55838->55920 55843 65621450 malloc 55844 655d3d19 55843->55844 55932 65620e80 55844->55932 55855 6561fd80 malloc 55856 655d3da6 55855->55856 55857 6561fb10 malloc 55856->55857 55858 655d3dbc 55857->55858 55859 6561fd80 malloc 55858->55859 55860 655d3dec 55859->55860 55958 6561f9d0 55860->55958 55864 655d3e04 55965 656208e0 55864->55965 55867 656208e0 2 API calls 55868 655d3e1f 55867->55868 55869 6561f9d0 malloc 55868->55869 55871 655d3e32 55869->55871 55870 6561f9d0 malloc 55873 655d3ec8 55870->55873 55871->55870 55872 655c7644 55871->55872 55872->55782 55872->55815 55874 656208e0 2 API calls 55873->55874 55875 655d3ed9 55874->55875 55876 6561fd80 malloc 55875->55876 55877 655d3efc 55876->55877 55878 6561fd80 malloc 55877->55878 55879 655d3f1e 55878->55879 55880 6561fd80 malloc 55879->55880 55881 655d3f3d 55880->55881 55882 6561fd80 malloc 55881->55882 55883 655d3f5f 55882->55883 55884 6561fd80 malloc 55883->55884 55885 655d3f7b 55884->55885 55886 6561fd80 malloc 55885->55886 55887 655d3f9a 55886->55887 55888 6561fd80 malloc 55887->55888 55889 655d3fb9 55888->55889 55890 6561fd80 malloc 55889->55890 55891 655d3fdb 55890->55891 55892 6561fd80 malloc 55891->55892 55893 655d3ff7 55892->55893 55894 6561fd80 malloc 55893->55894 55895 655d4019 55894->55895 55896 6561fd80 malloc 55895->55896 55897 655d4038 55896->55897 55898 6561fd80 malloc 55897->55898 55899 655d405a 55898->55899 55900 6561fd80 malloc 55899->55900 55901 655d4076 55900->55901 55902 6561fd80 malloc 55901->55902 55903 655d4098 55902->55903 55971 65621050 55903->55971 55905 655d40a2 55978 6563db10 55905->55978 55907 655d40b2 55907->55872 56006 6561f6e0 55907->56006 55909->55797 55910->55822 55911->55787 55912->55787 55913->55787 55914->55787 55915->55792 55916->55809 55917->55831 55918->55808 55919->55832 55921 65620d3a 55920->55921 56029 6563df90 malloc 55921->56029 55923 65620e00 55924 6561d300 malloc 55923->55924 55925 65620e18 55924->55925 55926 6561d300 malloc 55925->55926 55927 655d3d06 55926->55927 55928 65621450 55927->55928 55929 65621470 55928->55929 56030 6561d300 55929->56030 55933 65620e9c 55932->55933 55934 655d3d29 55933->55934 55935 6561fb10 malloc 55933->55935 55936 65621a50 55934->55936 55935->55934 56035 6561fb60 55936->56035 55939 65621ae1 55942 6561fb10 malloc 55939->55942 55940 65621a9c 55941 6561fd80 malloc 55940->55941 55943 655d3d40 55941->55943 55942->55943 55944 6561fd80 55943->55944 55945 6561d300 malloc 55944->55945 55946 655d3d64 55945->55946 55947 656218f0 55946->55947 55948 6561fb60 malloc 55947->55948 55949 65621910 55948->55949 55950 65621981 55949->55950 55951 6562193c 55949->55951 55953 6561fb10 malloc 55950->55953 55952 6561fd80 malloc 55951->55952 55954 655d3d71 55952->55954 55953->55954 55955 6561fb10 55954->55955 55956 6561d300 malloc 55955->55956 55957 655d3d87 55956->55957 55957->55855 55959 6561d300 malloc 55958->55959 55960 655d3dfc 55959->55960 55961 656200e0 55960->55961 55962 656200f6 55961->55962 55963 65620109 55962->55963 55964 6561d300 malloc 55962->55964 55963->55864 55964->55963 55966 656208f5 55965->55966 55967 656200e0 malloc 55966->55967 55968 65620870 55966->55968 55967->55968 55969 655d3e14 55968->55969 56038 65620230 abort 55968->56038 55969->55867 55972 6561f9d0 malloc 55971->55972 55973 65621069 55972->55973 55974 6561fb10 malloc 55973->55974 55975 6562109e 55974->55975 56039 65620f00 55975->56039 55979 6563db2c 55978->55979 55999 6563dce9 55978->55999 55980 6563dcd0 55979->55980 55982 6563db4a 55979->55982 55983 6563dca9 55979->55983 55985 6563f450 9 API calls 55980->55985 55980->55999 56071 6562c730 fwrite abort abort abort malloc 55982->56071 56058 6563f450 55983->56058 55985->55999 55986 6563dda9 memset 55986->55999 55989 6563e010 free 55989->55999 55990 6563dc4d 56054 65640ad0 55990->56054 55991 6563dc35 55992 6563dc47 55991->55992 55991->55999 55992->55990 55996 6563dc73 55992->55996 55994 6563dc60 55997 6563dc6a 55994->55997 56000 65640ad0 VirtualProtect 55994->56000 55995 6563db75 55995->55991 55995->55997 56004 6563dbc8 55995->56004 56074 6563e010 55996->56074 55997->55907 55999->55986 55999->55989 55999->55990 56077 65624670 13 API calls 55999->56077 56078 6563e530 malloc free 55999->56078 56002 6563dc9c 56000->56002 56002->55907 56003 6563f450 9 API calls 56003->56004 56004->55991 56004->55995 56004->56003 56072 6563f620 UnmapViewOfFile GetLastError _errno 56004->56072 56073 6562c730 fwrite abort abort abort malloc 56004->56073 56007 6563e010 free 56006->56007 56008 6561f70e 56007->56008 56009 6563e010 free 56008->56009 56010 6561f71b 56009->56010 56011 6563e010 free 56010->56011 56012 6561f738 56011->56012 56013 6563e010 free 56012->56013 56014 6561f748 56013->56014 56015 6563e010 free 56014->56015 56016 6561f758 56015->56016 56017 6563e010 free 56016->56017 56018 6561f768 56017->56018 56019 6563e010 free 56018->56019 56020 6561f778 56019->56020 56021 6561f7cf 56020->56021 56024 6563e010 free 56020->56024 56022 6563e010 free 56021->56022 56023 6561f7db 56022->56023 56025 6561f831 56023->56025 56027 6563e010 free 56023->56027 56024->56020 56026 6563e010 free 56025->56026 56028 6561f83d 56026->56028 56027->56023 56031 655d3d0e 56030->56031 56033 6561d345 56030->56033 56031->55843 56034 6563df90 malloc 56033->56034 56036 6561d300 malloc 56035->56036 56037 6561fb75 56036->56037 56037->55939 56037->55940 56038->55969 56046 6561f930 56039->56046 56042 6561d300 malloc 56043 65620f41 56042->56043 56049 65620870 56043->56049 56047 6561d300 malloc 56046->56047 56048 6561f93d 56047->56048 56048->56042 56050 6562088d 56049->56050 56052 65620895 56049->56052 56050->56052 56053 65620230 abort 56050->56053 56052->55905 56053->56052 56056 65640ada 56054->56056 56055 65640b06 VirtualProtect 56057 65640b1e 56055->56057 56056->56055 56056->56057 56057->55994 56059 6563f46a 56058->56059 56060 6563f4a7 _errno 56059->56060 56064 6563f608 56059->56064 56061 6563f570 _errno 56060->56061 56062 6563f4bf 56060->56062 56063 6563f57f 56061->56063 56062->56061 56065 6563f4d2 56062->56065 56063->55980 56066 6563f4e3 CreateFileMappingA 56065->56066 56067 6563f5d4 _get_osfhandle 56065->56067 56069 6563f513 MapViewOfFile CloseHandle 56066->56069 56070 6563f548 GetLastError _errno 56066->56070 56067->56066 56068 6563f5ee _errno 56067->56068 56068->56063 56069->56063 56069->56070 56070->55980 56071->55995 56072->56004 56073->56004 56075 6563e020 free 56074->56075 56076 6563e02d 56074->56076 56075->56076 56076->55994 56077->55999 56078->55999 56079 7ff6113010f6 56082 7ff611301154 56079->56082 56083 7ff61130118b 56082->56083 56084 7ff6113011f1 _amsg_exit 56083->56084 56085 7ff6113011fd 56083->56085 56086 7ff611301232 56084->56086 56085->56086 56087 7ff61130120a _initterm 56085->56087 56088 7ff61130124a _initterm 56086->56088 56089 7ff611301270 56086->56089 56087->56086 56088->56089 56098 7ff61130147c 56089->56098 56091 7ff611301309 56103 7ff61130d990 56091->56103 56094 7ff611301350 exit 56095 7ff61130135d 56094->56095 56096 7ff611301117 56095->56096 56097 7ff611301367 _cexit 56095->56097 56097->56096 56099 7ff6113014a2 56098->56099 56100 7ff6113014bd 56099->56100 56101 7ff611301558 56099->56101 56102 7ff6113014dc malloc memcpy 56100->56102 56101->56091 56102->56099 56105 7ff61130d9b6 56103->56105 56104 7ff61130da38 memset 56106 7ff61130da5f 56104->56106 56105->56104 56109 7ff6113016d0 56106->56109 56177 7ff611308fe0 56109->56177 56111 7ff6113016f3 56185 7ff6113021d0 calloc 56111->56185 56115 7ff611302e60 10 API calls 56166 7ff611303d85 56115->56166 56116 7ff611303cfa 56116->56166 56200 7ff611307e30 56116->56200 56117 7ff611309090 10 API calls 56117->56166 56119 7ff611303d2c 56121 7ff611303e00 56119->56121 56122 7ff611303d38 56119->56122 56120 7ff611304122 SetDllDirectoryW 56126 7ff611307020 12 API calls 56120->56126 56125 7ff611307f20 12 API calls 56121->56125 56123 7ff611307e30 15 API calls 56122->56123 56127 7ff611303d44 56123->56127 56124 7ff6113040e2 SetDllDirectoryW 56128 7ff611307020 12 API calls 56124->56128 56129 7ff611303e08 56125->56129 56126->56166 56130 7ff611303f28 56127->56130 56132 7ff611303d5e free 56127->56132 56172 7ff611303e59 56128->56172 56131 7ff6113022c0 44 API calls 56129->56131 56134 7ff611307f20 12 API calls 56130->56134 56133 7ff611303e16 56131->56133 56208 7ff611307f20 56132->56208 56133->56166 56246 7ff6113024a0 58 API calls 56133->56246 56137 7ff611303f40 56134->56137 56141 7ff6113022c0 44 API calls 56137->56141 56138 7ff611304650 11 API calls 56138->56166 56139 7ff6113022c0 44 API calls 56139->56166 56140 7ff611303d6f 56142 7ff611307f20 12 API calls 56140->56142 56141->56166 56145 7ff611303d77 56142->56145 56211 7ff6113022c0 56145->56211 56148 7ff611304292 fclose 56148->56166 56150 7ff611303e89 strcmp 56153 7ff611303ede 56150->56153 56150->56166 56151 7ff611307020 12 API calls 56151->56172 56236 7ff611303c00 56153->56236 56154 7ff6113071c0 FreeLibrary 56154->56172 56155 7ff6113024a0 58 API calls 56155->56166 56158 7ff611307060 free free free free 56158->56172 56161 7ff611303ec5 strcpy 56161->56153 56162 7ff611303eee 56249 7ff6113071c0 FreeLibrary 56162->56249 56163 7ff611303dd6 SetDllDirectoryW 56232 7ff611307020 calloc 56163->56232 56166->56115 56166->56117 56166->56120 56166->56124 56166->56138 56166->56139 56166->56148 56166->56150 56166->56155 56166->56161 56166->56163 56166->56172 56245 7ff611307060 free free free free 56166->56245 56248 7ff611303c80 fputc 56166->56248 56251 7ff6113036c0 114 API calls 56166->56251 56257 7ff611308bb0 malloc 56166->56257 56168 7ff611303f02 56250 7ff611307060 free free free free 56168->56250 56171 7ff611301340 56171->56094 56171->56095 56172->56148 56172->56150 56172->56151 56172->56154 56172->56158 56172->56166 56173 7ff611303ff0 56172->56173 56247 7ff611306b90 43 API calls 56172->56247 56252 7ff611307ec0 13 API calls 56172->56252 56253 7ff611308820 21 API calls 56172->56253 56255 7ff611306d80 99 API calls 56172->56255 56256 7ff611306fa0 43 API calls 56172->56256 56266 7ff611308260 30 API calls 56172->56266 56267 7ff6113072d0 11 API calls 56172->56267 56254 7ff611302210 free 56173->56254 56176 7ff611303ff8 56176->56171 56178 7ff611308ffe 56177->56178 56179 7ff611309059 56178->56179 56181 7ff61130900a 56178->56181 56179->56111 56181->56179 56182 7ff611309031 56181->56182 56268 7ff611308ec0 13 API calls 56181->56268 56183 7ff611309040 free 56182->56183 56183->56183 56184 7ff611309051 free 56183->56184 56184->56179 56186 7ff6113021ed 56185->56186 56188 7ff6113021e8 56185->56188 56269 7ff611302fe0 11 API calls 56186->56269 56188->56166 56189 7ff6113045a0 56188->56189 56270 7ff61130f020 56189->56270 56192 7ff6113045cc 56272 7ff611308ec0 13 API calls 56192->56272 56193 7ff6113045f8 56273 7ff611302f40 10 API calls 56193->56273 56196 7ff6113045dd 56197 7ff6113045ea 56196->56197 56274 7ff611302e60 10 API calls 56196->56274 56197->56116 56199 7ff61130461c 56199->56197 56201 7ff611307e3b 56200->56201 56202 7ff611309090 10 API calls 56201->56202 56203 7ff611307e50 GetEnvironmentVariableW 56202->56203 56204 7ff611307e78 ExpandEnvironmentStringsW 56203->56204 56205 7ff611307e66 56203->56205 56275 7ff611308ec0 13 API calls 56204->56275 56205->56119 56207 7ff611307e9c 56207->56119 56207->56205 56209 7ff611309090 10 API calls 56208->56209 56210 7ff611307f33 SetEnvironmentVariableW free 56209->56210 56210->56140 56212 7ff6113022d0 56211->56212 56276 7ff611301af0 56212->56276 56215 7ff6113022fb 56215->56166 56216 7ff611301af0 fputc 56217 7ff61130232b 56216->56217 56217->56215 56279 7ff611301f90 56217->56279 56219 7ff61130233a 56219->56215 56307 7ff6113042f0 56219->56307 56223 7ff61130239a 56224 7ff6113023ac 56223->56224 56225 7ff611302408 56223->56225 56226 7ff6113042f0 18 API calls 56224->56226 56227 7ff6113042f0 18 API calls 56225->56227 56228 7ff6113023be strcpy 56226->56228 56229 7ff611302422 56227->56229 56228->56166 56316 7ff611304390 56229->56316 56231 7ff611302430 56231->56228 56233 7ff61130703d 56232->56233 56234 7ff611307038 56232->56234 56355 7ff611302fe0 11 API calls 56233->56355 56234->56166 56356 7ff6113062f0 56236->56356 56242 7ff611303c2f 56244 7ff611303c3b 56242->56244 56435 7ff611306880 11 API calls 56242->56435 56244->56162 56245->56166 56246->56166 56247->56172 56248->56166 56249->56168 56250->56171 56251->56166 56252->56172 56253->56172 56254->56176 56255->56172 56256->56172 56258 7ff611308bdf 56257->56258 56265 7ff611308c99 free 56257->56265 56259 7ff611310020 2 API calls 56258->56259 56261 7ff611308bef 56259->56261 56261->56265 56535 7ff611310110 56261->56535 56263 7ff611310020 2 API calls 56264 7ff611308bff 56263->56264 56264->56263 56264->56265 56265->56166 56266->56172 56267->56172 56268->56181 56269->56188 56271 7ff6113045ac GetModuleFileNameW 56270->56271 56271->56192 56271->56193 56272->56196 56273->56197 56274->56199 56275->56207 56277 7ff6113101e0 fputc 56276->56277 56278 7ff611301b0d 56277->56278 56278->56215 56278->56216 56280 7ff611304650 11 API calls 56279->56280 56281 7ff611301faa 56280->56281 56282 7ff61130218c 56281->56282 56283 7ff611308bb0 5 API calls 56281->56283 56330 7ff611302fe0 11 API calls 56282->56330 56284 7ff611301fe3 56283->56284 56285 7ff611301feb 56284->56285 56288 7ff611310020 2 API calls 56284->56288 56287 7ff611301ff0 fclose 56285->56287 56287->56219 56290 7ff611302015 56288->56290 56289 7ff6113021ae 56289->56289 56291 7ff611302140 56290->56291 56292 7ff61130201d fread 56290->56292 56327 7ff611302fe0 11 API calls 56291->56327 56294 7ff611302153 56292->56294 56295 7ff61130203d 56292->56295 56328 7ff611302fe0 11 API calls 56294->56328 56296 7ff611310020 2 API calls 56295->56296 56298 7ff611302086 malloc 56296->56298 56298->56282 56300 7ff6113020a2 fread 56298->56300 56299 7ff611302173 56329 7ff611302e60 10 API calls 56299->56329 56301 7ff611302120 56300->56301 56302 7ff6113020b8 56300->56302 56326 7ff611302fe0 11 API calls 56301->56326 56302->56299 56306 7ff6113020d6 56302->56306 56305 7ff611302133 56305->56291 56306->56287 56308 7ff6113042fc 56307->56308 56331 7ff6113042c0 56308->56331 56313 7ff6113042c0 fputc 56314 7ff61130238b 56313->56314 56315 7ff611302240 strlen strncmp 56314->56315 56315->56223 56317 7ff6113042c0 fputc 56316->56317 56318 7ff6113043b1 56317->56318 56319 7ff611304428 56318->56319 56320 7ff6113043d2 strlen 56318->56320 56319->56231 56320->56319 56321 7ff6113043e7 56320->56321 56322 7ff611304410 56321->56322 56323 7ff6113043f7 strncat 56321->56323 56325 7ff611304415 strlen 56322->56325 56324 7ff6113043fc 56323->56324 56324->56231 56325->56324 56326->56305 56327->56294 56328->56299 56329->56282 56330->56289 56332 7ff6113101e0 fputc 56331->56332 56333 7ff6113042e4 56332->56333 56333->56314 56334 7ff61130f3b0 56333->56334 56335 7ff61130f3ce 56334->56335 56336 7ff61130f3e9 setlocale 56335->56336 56337 7ff61130f3d9 _strdup 56335->56337 56338 7ff61130f408 56336->56338 56339 7ff61130f824 wcstombs realloc wcstombs setlocale free 56336->56339 56337->56336 56338->56339 56340 7ff61130f417 mbstowcs 56338->56340 56341 7ff611304332 56339->56341 56342 7ff61130f020 56340->56342 56341->56313 56343 7ff61130f45f mbstowcs 56342->56343 56344 7ff61130f4ad 56343->56344 56345 7ff61130f514 56343->56345 56344->56345 56347 7ff61130f4ee setlocale free 56344->56347 56346 7ff61130f81a 56345->56346 56349 7ff61130f544 56345->56349 56346->56339 56347->56341 56348 7ff61130f5c8 wcstombs 56352 7ff61130f7f7 setlocale free 56348->56352 56354 7ff61130f74e 56348->56354 56349->56348 56351 7ff61130f5c3 wcstombs realloc wcstombs 56349->56351 56351->56352 56352->56341 56354->56352 56355->56234 56357 7ff6113062fe 56356->56357 56436 7ff6113062c0 56357->56436 56360 7ff611306330 56363 7ff611304390 4 API calls 56360->56363 56381 7ff61130633f 56360->56381 56361 7ff611306407 56451 7ff611302e60 10 API calls 56361->56451 56365 7ff6113063a9 56363->56365 56364 7ff611304390 4 API calls 56366 7ff611306354 56364->56366 56367 7ff6113063ae 56365->56367 56450 7ff611302e60 10 API calls 56365->56450 56368 7ff611306359 56366->56368 56449 7ff611302e60 10 API calls 56366->56449 56442 7ff6113044c0 56367->56442 56439 7ff6113087c0 56368->56439 56374 7ff611306361 56375 7ff61130636d 56374->56375 56376 7ff611306429 56374->56376 56448 7ff6113059c0 54 API calls 56375->56448 56452 7ff611302f40 10 API calls 56376->56452 56379 7ff6113087c0 12 API calls 56379->56381 56380 7ff611303c0d 56380->56244 56382 7ff611306450 56380->56382 56381->56364 56466 7ff6113049f0 calloc 56382->56466 56385 7ff611306612 56523 7ff611302e60 10 API calls 56385->56523 56386 7ff61130646c 56388 7ff6113065c2 56386->56388 56390 7ff61130647c 56386->56390 56518 7ff611302e60 10 API calls 56388->56518 56391 7ff61130662e 56390->56391 56392 7ff61130648d 56390->56392 56525 7ff611302e60 10 API calls 56391->56525 56481 7ff611304db0 56392->56481 56396 7ff61130653d 56509 7ff611304960 56396->56509 56398 7ff6113064a4 56399 7ff6113064ac 56398->56399 56400 7ff6113065da 56398->56400 56402 7ff6113064bf 56399->56402 56403 7ff6113065e8 56399->56403 56519 7ff611302e60 10 API calls 56400->56519 56493 7ff611304ee0 56402->56493 56520 7ff611302e60 10 API calls 56403->56520 56406 7ff6113064ca 56407 7ff6113064d2 56406->56407 56408 7ff6113065f6 56406->56408 56502 7ff6113051b0 calloc 56407->56502 56521 7ff611302e60 10 API calls 56408->56521 56412 7ff6113064e5 56415 7ff611306620 56412->56415 56416 7ff6113064f8 56412->56416 56413 7ff611306604 56522 7ff611302e60 10 API calls 56413->56522 56524 7ff611302e60 10 API calls 56415->56524 56418 7ff61130656e fflush 56416->56418 56420 7ff6113064ff 56416->56420 56419 7ff61130657d fflush 56418->56419 56419->56420 56420->56396 56517 7ff611302e60 10 API calls 56420->56517 56422 7ff611306640 strlen 56423 7ff61130667d 56422->56423 56424 7ff611306799 56423->56424 56429 7ff611306689 56423->56429 56534 7ff611302e60 10 API calls 56424->56534 56426 7ff611306770 56426->56242 56427 7ff611306788 56427->56242 56428 7ff611301b30 30 API calls 56428->56429 56429->56427 56429->56428 56430 7ff611306733 56429->56430 56434 7ff6113066db free 56429->56434 56533 7ff611302e60 10 API calls 56430->56533 56432 7ff611306742 free 56432->56426 56434->56429 56435->56244 56437 7ff6113101e0 fputc 56436->56437 56438 7ff6113062e4 56437->56438 56438->56360 56438->56361 56440 7ff611309090 10 API calls 56439->56440 56441 7ff6113087d3 LoadLibraryExW free 56440->56441 56441->56374 56443 7ff6113044cb 56442->56443 56444 7ff611309090 10 API calls 56443->56444 56445 7ff6113044e4 56444->56445 56453 7ff61130ff1b 56445->56453 56448->56380 56449->56368 56450->56367 56451->56380 56452->56380 56460 7ff61130fd30 56453->56460 56455 7ff61130ff37 56456 7ff61130ff58 free 56455->56456 56457 7ff61130ff64 56455->56457 56456->56457 56458 7ff61130ff6a memset 56457->56458 56459 7ff6113044f1 56457->56459 56458->56459 56459->56379 56459->56381 56461 7ff61130fd4f 56460->56461 56462 7ff61130fd91 56460->56462 56461->56462 56463 7ff61130fd5f wcslen 56461->56463 56462->56455 56463->56462 56465 7ff61130fd74 56463->56465 56464 7ff61130fec6 malloc memcpy 56464->56462 56465->56462 56465->56464 56467 7ff611304c88 56466->56467 56476 7ff611304a1e 56466->56476 56467->56385 56467->56386 56468 7ff611304d00 56469 7ff611304a81 strncmp 56469->56476 56470 7ff611304aa5 strcmp 56470->56476 56471 7ff611304ad0 strcmp 56471->56476 56472 7ff611304b30 calloc calloc 56473 7ff611304c80 56472->56473 56480 7ff611304b65 56472->56480 56475 7ff611304960 4 API calls 56473->56475 56474 7ff611304af8 strcmp 56474->56476 56475->56467 56476->56468 56476->56469 56476->56470 56476->56471 56476->56472 56476->56474 56526 7ff6113047f0 strlen strncmp 56476->56526 56478 7ff611304860 mbstowcs 56478->56480 56479 7ff6113047f0 strlen strncmp 56479->56480 56480->56467 56480->56473 56480->56478 56480->56479 56482 7ff611304dc4 56481->56482 56483 7ff611304e28 56481->56483 56484 7ff611304df0 56482->56484 56485 7ff611304dc6 56482->56485 56529 7ff6113048b0 11 API calls 56483->56529 56487 7ff611304e18 56484->56487 56528 7ff6113048b0 11 API calls 56484->56528 56485->56487 56527 7ff6113048b0 11 API calls 56485->56527 56487->56398 56488 7ff611304e3e 56488->56398 56491 7ff611304de6 56491->56398 56492 7ff611304e0d 56492->56398 56494 7ff611304ef2 56493->56494 56530 7ff611304930 56494->56530 56497 7ff611304930 fputc 56500 7ff611304f83 56497->56500 56499 7ff611309090 10 API calls 56499->56500 56500->56499 56501 7ff611304fd1 free free free 56500->56501 56501->56406 56503 7ff6113052d5 56502->56503 56505 7ff6113051e2 56502->56505 56503->56412 56503->56413 56504 7ff611309090 10 API calls 56504->56505 56505->56504 56506 7ff611305226 56505->56506 56506->56503 56507 7ff6113052cd free 56506->56507 56508 7ff6113052b8 free 56506->56508 56507->56503 56508->56507 56508->56508 56510 7ff611303c23 56509->56510 56511 7ff61130496e 56509->56511 56510->56244 56510->56422 56512 7ff611304996 free 56511->56512 56513 7ff611304980 free 56511->56513 56514 7ff6113049c6 free 56512->56514 56515 7ff6113049a6 56512->56515 56513->56512 56513->56513 56514->56510 56516 7ff6113049b0 free 56515->56516 56516->56514 56516->56516 56517->56396 56518->56396 56519->56396 56520->56396 56521->56396 56522->56396 56523->56396 56524->56396 56525->56396 56526->56476 56527->56491 56528->56492 56529->56488 56531 7ff6113101e0 fputc 56530->56531 56532 7ff611304954 56531->56532 56532->56497 56532->56501 56533->56432 56534->56426 56538 7ff611310130 fgetpos 56535->56538 56539 7ff611310128 56538->56539 56539->56264

                                                                                                                                                                                                                              Executed Functions

                                                                                                                                                                                                                              Function 655C6580 Relevance: 118.2, APIs: 51, Strings: 16, Instructions: 915librarystringloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PySys_GetObject.PYTHON311 ref: 655C65A1
                                                                                                                                                                                                                              • PyTuple_GetItem.PYTHON311 ref: 655C65BB
                                                                                                                                                                                                                              • PyLong_AsLong.PYTHON311 ref: 655C65D0
                                                                                                                                                                                                                              • PyTuple_GetItem.PYTHON311 ref: 655C65E0
                                                                                                                                                                                                                              • PyLong_AsLong.PYTHON311 ref: 655C65EE
                                                                                                                                                                                                                              • PySys_GetObject.PYTHON311 ref: 655C65FD
                                                                                                                                                                                                                              • PyLong_AsVoidPtr.PYTHON311 ref: 655C6609
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32 ref: 655C662E
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32 ref: 655C664C
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32 ref: 655C666A
                                                                                                                                                                                                                              • PyModule_Create2.PYTHON311 ref: 655C6694
                                                                                                                                                                                                                              • PyModule_GetName.PYTHON311 ref: 655C66A9
                                                                                                                                                                                                                              • strrchr.MSVCRT ref: 655C66CE
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655C66E4
                                                                                                                                                                                                                              • memcpy.MSVCRT ref: 655C66FE
                                                                                                                                                                                                                              • PyBytes_FromStringAndSize.PYTHON311 ref: 655C6751
                                                                                                                                                                                                                              • PyBytes_AsString.PYTHON311 ref: 655C676B
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655C677F
                                                                                                                                                                                                                              • PyCMethod_New.PYTHON311 ref: 655C67CD
                                                                                                                                                                                                                              • PyCMethod_New.PYTHON311 ref: 655C6813
                                                                                                                                                                                                                              • PyCMethod_New.PYTHON311 ref: 655C6859
                                                                                                                                                                                                                              • PyBytes_FromStringAndSize.PYTHON311 ref: 655C6883
                                                                                                                                                                                                                              • PyBytes_AsString.PYTHON311 ref: 655C6899
                                                                                                                                                                                                                              • _time64.MSVCRT ref: 655C6976
                                                                                                                                                                                                                              • srand.MSVCRT ref: 655C697E
                                                                                                                                                                                                                              • strstr.MSVCRT ref: 655C6B25
                                                                                                                                                                                                                              • strncmp.MSVCRT ref: 655C6B61
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C6BD4
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C6C0A
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C6C19
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655C6C3A
                                                                                                                                                                                                                              • free.MSVCRT ref: 655C6CA4
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655C6CB0
                                                                                                                                                                                                                              • memcpy.MSVCRT ref: 655C6CD3
                                                                                                                                                                                                                              • free.MSVCRT ref: 655C6D02
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655C6D0E
                                                                                                                                                                                                                              • memcpy.MSVCRT ref: 655C6D31
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C7378
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDB03
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDB20
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDB42
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDB62
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDB82
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDBA2
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDBC2
                                                                                                                                                                                                                                • Part of subcall function 655DDAD0: memcmp.MSVCRT ref: 655DDBE2
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD873
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD893
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD8B5
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD8D5
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD8F5
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD915
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD935
                                                                                                                                                                                                                                • Part of subcall function 655DD840: memcmp.MSVCRT ref: 655DD955
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD29B
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD2C5
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD2E4
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD303
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD322
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD33D
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD358
                                                                                                                                                                                                                                • Part of subcall function 655DD270: strcmp.MSVCRT ref: 655DD373
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD53B
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD55F
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD57B
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD59A
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD5B9
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD5D4
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD5EF
                                                                                                                                                                                                                                • Part of subcall function 655DD510: strcmp.MSVCRT ref: 655DD60A
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD3EB
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD415
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD434
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD453
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD472
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD48D
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD4A8
                                                                                                                                                                                                                                • Part of subcall function 655DD3C0: strcmp.MSVCRT ref: 655DD4C3
                                                                                                                                                                                                                              • PyBytes_AsStringAndSize.PYTHON311 ref: 655C6EA8
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmp$memcmp$Bytes_Stringmalloc$AddressLong_Method_ProcSizememcpy$DeallocErr_FormatFromItemLongModule_ObjectSys_Tuple_free$Create2NameVoid_time64srandstrncmpstrrchrstrstr
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$,*$.pyarmor.ikey$000000$C_ASSERT_ARMORED_INDEX$C_ENTER_CO_OBJECT_INDEX$C_LEAVE_CO_OBJECT_INDEX$PyCell_Get$PyCell_New$PyCell_Set$aes$dllhandle$pyarmor_runtime_$sha256$sprng$version_info
                                                                                                                                                                                                                              • API String ID: 3695841847-3717260241
                                                                                                                                                                                                                              • Opcode ID: c49689d9fb9b6adb2433b99e16241ad41eae1ea0e4a5ccbbb1b073d1b8f7bae8
                                                                                                                                                                                                                              • Instruction ID: 9088fb379de0069e41cd69e83f0e25aba7ff23454b57df15404cd342592abb7a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c49689d9fb9b6adb2433b99e16241ad41eae1ea0e4a5ccbbb1b073d1b8f7bae8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AC821672315B8482EB01CF69D85876A3BA2FB85BC9F85805EDE4E0BB54DF39C516C342
                                                                                                                                                                                                                              Function 655C7590 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 455COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 578 655c7590-655c75b4 579 655c75ba-655c75bd 578->579 580 655c7880-655c7898 call 6563eb00 578->580 582 655c7900-655c790a 579->582 583 655c75c3-655c75d3 579->583 593 655c789e-655c78a8 580->593 594 655c7970-655c7984 call 6563f250 580->594 584 655c7b90-655c7b97 582->584 585 655c7910-655c791c 582->585 587 655c75d9-655c75df 583->587 588 655c79d0-655c79da 583->588 597 655c7ba0-655c7baa 584->597 589 655c7d42-655c7d4d exit 585->589 590 655c7922-655c7935 call 655c13c0 585->590 595 655c75e5-655c75e7 587->595 596 655c76b0-655c76be 587->596 591 655c79e0-655c79ec 588->591 592 655c7c13-655c7c1a 588->592 619 655c793b-655c795d PyErr_Format 590->619 620 655c7ab0-655c7ab7 590->620 591->589 599 655c79f2-655c7a05 call 655c13c0 591->599 606 655c7c22-655c7c29 592->606 601 655c78ae-655c78ba 593->601 602 655c7ce1-655c7ce8 593->602 594->593 625 655c798a-655c7999 call 6563eb60 594->625 603 655c75e9-655c75f5 595->603 604 655c7652-655c7656 595->604 596->595 605 655c76c4-655c76d2 596->605 608 655c7c5f-655c7c69 597->608 609 655c7bb0-655c7bb6 597->609 635 655c7a0b-655c7a2d PyErr_Format 599->635 636 655c7c04-655c7c0b 599->636 601->589 615 655c78c0-655c78cd call 655ddd20 601->615 617 655c7cf0-655c7cf3 free 602->617 603->597 616 655c75fb-655c760b malloc 603->616 612 655c765c-655c767b call 655ce6e0 604->612 613 655c7a40-655c7a4a 604->613 605->604 607 655c76d8 605->607 630 655c7c31-655c7c3b 606->630 607->603 618 655c7bb9-655c7bbc 608->618 609->618 633 655c7695-655c76a6 612->633 642 655c767d-655c7683 612->642 623 655c7b80-655c7b87 613->623 624 655c7a50-655c7a5c 613->624 646 655c7cd2-655c7cd9 615->646 647 655c78d3-655c78f5 PyErr_Format 615->647 627 655c7cf8-655c7d01 PyErr_NoMemory 616->627 628 655c7611-655c761d call 655d3cb0 616->628 617->627 618->589 634 655c7bc2-655c7bd5 call 655c13c0 618->634 619->594 641 655c7ac0-655c7acf 620->641 623->584 624->589 637 655c7a62-655c7a75 call 655c13c0 624->637 625->593 653 655c799f-655c79ba call 6563ee30 625->653 627->633 628->617 648 655c7623-655c763f call 655d3ce0 628->648 640 655c7b55-655c7b73 PyErr_Format 630->640 664 655c7bd7-655c7bde 634->664 665 655c7c50-655c7c5a 634->665 635->613 636->592 637->606 666 655c7a7b-655c7a9d PyErr_Format 637->666 640->633 649 655c7ad5-655c7ae0 641->649 650 655c7767-655c776d 641->650 651 655c7689-655c768b 642->651 652 655c7862-655c7875 memset 642->652 646->602 647->582 668 655c7644-655c7647 648->668 649->633 659 655c7ae6-655c7aec 649->659 656 655c776f-655c777f call 655cf1a0 650->656 657 655c77c4-655c77ce 650->657 660 655c7830-655c783a call 655cf210 651->660 661 655c7691-655c7693 651->661 652->661 663 655c787b 652->663 653->593 683 655c79c0 653->683 656->657 685 655c7781-655c7785 656->685 671 655c77d4-655c77e0 657->671 672 655c7d15-655c7d1c 657->672 669 655c7afe-655c7b01 659->669 689 655c7b10-655c7b1a 660->689 690 655c7840-655c784b 660->690 661->633 673 655c76e0-655c76fe call 655cf1a0 661->673 663->660 670 655c7be1-655c7bff PyErr_Format 664->670 665->670 666->620 677 655c764d 668->677 678 655c7c6e-655c7c78 668->678 679 655c7af0-655c7af8 669->679 680 655c7b03 669->680 670->633 671->589 681 655c77e6-655c77f9 call 655c13c0 671->681 692 655c7d24-655c7d2e 672->692 699 655c7700-655c7704 673->699 700 655c7743-655c7749 673->700 677->604 686 655c7c7e-655c7c84 678->686 687 655c7d33-655c7d3d 678->687 679->633 679->669 680->650 705 655c77ff-655c7827 PyErr_Format 681->705 706 655c7d06-655c7d0d 681->706 683->588 685->657 693 655c7787-655c7796 685->693 694 655c7c87-655c7c8a 686->694 687->694 695 655c7c40-655c7c47 689->695 696 655c7b20-655c7b2c 689->696 690->689 698 655c7851-655c7857 690->698 701 655c7caf-655c7ccd PyErr_Format 692->701 693->657 702 655c7798-655c77a3 693->702 694->589 703 655c7c90-655c7ca3 call 655c13c0 694->703 695->665 696->589 704 655c7b32-655c7b45 call 655c13c0 696->704 698->633 707 655c785d 698->707 699->700 708 655c7706-655c7715 699->708 700->657 709 655c774b-655c775b call 655cf1a0 700->709 701->633 702->633 710 655c77a9-655c77af 702->710 703->692 721 655c7ca5-655c7cac 703->721 704->630 722 655c7b4b-655c7b52 704->722 705->633 706->672 707->673 708->700 713 655c7717-655c7722 708->713 709->650 724 655c775d-655c7761 709->724 715 655c77bf-655c77c2 710->715 713->633 718 655c7728-655c772e 713->718 715->657 720 655c77b1-655c77b9 715->720 723 655c773e-655c7741 718->723 720->633 720->715 721->701 722->640 723->700 725 655c7730-655c7738 723->725 724->641 724->650 725->633 725->723
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_Format$malloc
                                                                                                                                                                                                                              • String ID: %s (%d:%d)
                                                                                                                                                                                                                              • API String ID: 1817594650-1595188566
                                                                                                                                                                                                                              • Opcode ID: 8a995d37fb69e98e2f555d5dc7a50ec56f8a4c957936f599c74ed256fc7057be
                                                                                                                                                                                                                              • Instruction ID: e175f13fffbb985779171ffd35094e7dcb566cda0f4a86c9aa0ba5d2b99f7bf5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8a995d37fb69e98e2f555d5dc7a50ec56f8a4c957936f599c74ed256fc7057be
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4B02C071328B4481EF14CB6AD99836937A2FB85B89F44489ECE5E0BB91DF3DC151C782
                                                                                                                                                                                                                              Function 00007FF611301154 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _initterm$_amsg_exit_cexitexit
                                                                                                                                                                                                                              • String ID: 0
                                                                                                                                                                                                                              • API String ID: 602970348-4108050209
                                                                                                                                                                                                                              • Opcode ID: 68b42a7169f47ea2a0c2489e8fdb899db89ccd3641b59c7d876ca4fdc4d75048
                                                                                                                                                                                                                              • Instruction ID: 32e468780db96470642340ab7d6b11e790d630cf4aa8f3085b8af854b9925a1a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 68b42a7169f47ea2a0c2489e8fdb899db89ccd3641b59c7d876ca4fdc4d75048
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2619279A08F0689FB01ABA9E98436937A8BB48FA4F404435DD0DD7769DF7CE4448790
                                                                                                                                                                                                                              Function 655C5870 Relevance: 59.8, APIs: 28, Strings: 6, Instructions: 328COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 221 655c5870-655c589f 223 655c58dd-655c58e6 call 655c7590 221->223 224 655c58a1-655c58c1 221->224 228 655c58eb-655c58f1 223->228 225 655c58c4 call 655cfda0 224->225 227 655c58c9-655c58cc 225->227 231 655c6315-655c6328 call 655c80a0 227->231 232 655c58d2-655c58d9 227->232 229 655c58f7-655c58fd 228->229 230 655c54d0-655c54ef call 655cf210 228->230 233 655c5ac6-655c5ace 229->233 234 655c5903-655c5905 229->234 247 655c54f1-655c5508 PyUnicode_FromFormat 230->247 248 655c5562 230->248 231->230 232->223 233->234 239 655c5ad4-655c5add PyEval_GetFrame 233->239 237 655c5918-655c593c PyUnicode_AsUTF8 234->237 238 655c5907-655c5912 234->238 243 655c593e-655c5956 237->243 244 655c5958-655c5972 PyImport_GetModuleDict PyDict_GetItem 237->244 238->237 242 655c6199-655c61a3 238->242 245 655c62a6-655c62aa 239->245 246 655c5ae3-655c5b00 239->246 249 655c61a9-655c61b5 242->249 250 655c6306-655c630d 242->250 243->244 251 655c599d-655c59bf PyImport_ExecCodeModuleObject PyErr_Occurred 243->251 244->251 252 655c5974-655c5997 PyModule_GetDict PyDict_GetItemString 244->252 245->234 246->234 254 655c5b06-655c5b11 246->254 247->248 255 655c550a-655c5519 Py_DecRef 247->255 253 655c5564-655c5576 248->253 256 655c636c-655c638e exit 249->256 257 655c61bb-655c61ce call 655c13c0 249->257 250->231 251->230 259 655c59c5-655c59c9 251->259 252->251 258 655c60e5-655c60f7 PyEval_EvalCode 252->258 254->234 255->253 260 655c6394-655c639e 256->260 261 655c64a5-655c64ac 256->261 276 655c61d4-655c61f9 PyErr_Format 257->276 277 655c62f7-655c62fe 257->277 262 655c60fd-655c611c Py_DecRef Py_IncRef 258->262 263 655c551b-655c553a call 655cf210 258->263 265 655c59dc-655c59e9 259->265 266 655c59cb-655c59d8 259->266 267 655c64c4-655c64cb 260->267 268 655c63a4-655c63ae 260->268 262->253 263->248 281 655c553c-655c5553 PyUnicode_FromFormat 263->281 265->253 266->265 271 655c64cd-655c64d7 267->271 272 655c64b0-655c64bf call 655cfec0 267->272 273 655c63cc-655c63db call 655d3ca0 268->273 274 655c63b0-655c63ca call 655d3cd0 free 268->274 271->274 279 655c64dd 271->279 272->267 286 655c63dd free 273->286 287 655c63e2-655c63ec 273->287 274->273 276->230 277->250 279->273 281->248 284 655c5555-655c555c Py_DecRef 281->284 284->248 286->287 288 655c63ee free 287->288 289 655c63f3-655c63fd 287->289 288->289 290 655c63ff free 289->290 291 655c6404-655c640b 289->291 290->291 292 655c640d free 291->292 293 655c6412-655c641c 291->293 292->293 294 655c641e-655c6422 293->294 295 655c6428-655c642f 293->295 294->295 296 655c64e2-655c64ef _Py_Dealloc 294->296 297 655c643b-655c6445 295->297 298 655c6431-655c6435 295->298 296->298 302 655c64f5 296->302 300 655c6447-655c644b 297->300 301 655c6451-655c6458 297->301 298->297 299 655c6500-655c6510 _Py_Dealloc 298->299 299->300 305 655c6516 299->305 300->301 303 655c6520-655c652d _Py_Dealloc 300->303 301->261 304 655c645a-655c6460 301->304 302->297 303->304 308 655c6533 303->308 306 655c646c-655c6473 304->306 307 655c6462-655c6466 304->307 305->301 310 655c647f-655c6486 306->310 311 655c6475-655c6479 306->311 307->306 309 655c6550-655c655a _Py_Dealloc 307->309 308->261 309->306 313 655c6488-655c648c 310->313 314 655c6492-655c6499 310->314 311->310 312 655c6570-655c657a _Py_Dealloc 311->312 312->310 313->314 315 655c6560-655c656a _Py_Dealloc 313->315 314->261 316 655c649b-655c649f 314->316 315->314 316->261 317 655c6540-655c6547 _Py_Dealloc 316->317 317->309
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyUnicode_FromFormat.PYTHON311 ref: 655C54FF
                                                                                                                                                                                                                              • Py_DecRef.PYTHON311 ref: 655C5513
                                                                                                                                                                                                                              • PyUnicode_AsUTF8.PYTHON311 ref: 655C5924
                                                                                                                                                                                                                              • PyImport_GetModuleDict.PYTHON311 ref: 655C5958
                                                                                                                                                                                                                              • PyDict_GetItem.PYTHON311 ref: 655C5966
                                                                                                                                                                                                                              • PyModule_GetDict.PYTHON311 ref: 655C5977
                                                                                                                                                                                                                              • PyDict_GetItemString.PYTHON311 ref: 655C598A
                                                                                                                                                                                                                              • PyImport_ExecCodeModuleObject.PYTHON311 ref: 655C59AD
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C59B6
                                                                                                                                                                                                                                • Part of subcall function 655CFDA0: VirtualAlloc.KERNEL32 ref: 655CFDF9
                                                                                                                                                                                                                                • Part of subcall function 655CFDA0: memcpy.MSVCRT ref: 655CFE1C
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DictDict_Import_ItemModuleUnicode_$AllocCodeErr_ExecFormatFromModule_ObjectOccurredStringVirtualmemcpy
                                                                                                                                                                                                                              • String ID: $%s (%d:%d)$<frozen %U>$__main__$__mp_main__$__spec__
                                                                                                                                                                                                                              • API String ID: 2800235986-2782528897
                                                                                                                                                                                                                              • Opcode ID: d56c9e0c0242500afa0d281a4e7b82a01fadbc5cb55a1c2f50243ce13058f488
                                                                                                                                                                                                                              • Instruction ID: 442df36ffcee78a0791b5f7407c3daf34482bf8b1eaa455678c73e0b158be5d8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d56c9e0c0242500afa0d281a4e7b82a01fadbc5cb55a1c2f50243ce13058f488
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6CD1A02230AB8085EF05CFAAD89836877A1FB85F99F4844A9DE5E07764DF29C155C342
                                                                                                                                                                                                                              Function 00007FF6113037E0 Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 254COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 318 7ff6113037e0-7ff611303816 call 7ff61130f020 322 7ff611303a51-7ff611303a5d call 7ff611302e60 318->322 323 7ff61130381c-7ff61130382e 318->323 328 7ff611303a62-7ff611303a6e call 7ff611302e60 322->328 327 7ff611303834-7ff611303838 323->327 323->328 330 7ff611303930 327->330 331 7ff61130383e-7ff611303845 327->331 337 7ff611303a73-7ff611303a98 328->337 334 7ff611303932-7ff611303945 330->334 333 7ff611303868-7ff61130386c 331->333 335 7ff611303850-7ff611303862 call 7ff611301b20 333->335 336 7ff61130386e-7ff6113038b2 call 7ff611301b30 call 7ff611303240 333->336 335->330 335->333 347 7ff6113038b8-7ff6113038f8 336->347 348 7ff611303946-7ff61130394d call 7ff611302e60 336->348 344 7ff611303bce-7ff611303bda 337->344 345 7ff611303a9e-7ff611303ab9 337->345 356 7ff611303bdf-7ff611303be1 344->356 354 7ff611303bc0-7ff611303bc7 345->354 355 7ff611303abf-7ff611303ae3 345->355 366 7ff6113038fa-7ff61130391f 347->366 367 7ff611303959-7ff611303971 call 7ff611302e60 347->367 353 7ff611303952-7ff611303957 348->353 353->334 354->344 355->356 360 7ff611303ae9-7ff611303b87 355->360 357 7ff611303ba8-7ff611303bbb 356->357 357->354 360->356 388 7ff611303b89-7ff611303b9b 360->388 375 7ff611303973-7ff6113039c9 366->375 376 7ff611303921-7ff611303929 free 366->376 367->353 386 7ff6113039cb-7ff6113039d3 _strdup 375->386 387 7ff6113039d6-7ff6113039f7 call 7ff611302240 375->387 376->335 386->387 387->337 394 7ff6113039f9-7ff611303a4c _strdup call 7ff611302cc0 free * 2 387->394 388->357 392 7ff611303b9d-7ff611303ba5 _strdup 388->392 392->357 394->334
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID: %s%c%s.py$Absolute path to script exceeds PATH_MAX$Could not get __main__ module's dict.$Could not get __main__ module.$Failed to unmarshal code object for %s$Traceback is disabled via bootloader option.$\$__file__$__main__$_pyi_main_co$format_exception$pyi-disable-windowed-traceback$traceback
                                                                                                                                                                                                                              • API String ID: 1294909896-4198433784
                                                                                                                                                                                                                              • Opcode ID: a910d1081c493ede87baa9a3e2d4ef4e79b0eb8e38c4ffb82442c3980188c074
                                                                                                                                                                                                                              • Instruction ID: 56c776225090d59bfb3fa0882e7a3a49fa7be6b75401942f9dbc3034880c9aa5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a910d1081c493ede87baa9a3e2d4ef4e79b0eb8e38c4ffb82442c3980188c074
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E8B13F29B09F4A85EB14AB26E85417A23B9BF89FE4F444032DD1EC7768DE3CE505D340
                                                                                                                                                                                                                              Function 655C5881 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 217COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 399 655c5881-655c5885 400 655c5e79-655c5e83 399->400 401 655c5887-655c5890 399->401 404 655c5e89-655c5e95 400->404 405 655c60c0-655c60c7 400->405 402 655c589b-655c589f 401->402 403 655c5892-655c5899 401->403 408 655c58dd-655c58e6 call 655c7590 402->408 409 655c58a1-655c58c4 call 655cfda0 402->409 403->402 407 655c5880 403->407 406 655c636c-655c638e exit 404->406 410 655c5e9b-655c5eae call 655c13c0 404->410 405->406 411 655c6394-655c639e 406->411 412 655c64a5-655c64ac 406->412 407->399 420 655c58eb-655c58f1 408->420 418 655c58c9-655c58cc 409->418 429 655c5eb4-655c5ed3 PyErr_Format 410->429 430 655c60b1-655c60b8 410->430 416 655c64c4-655c64cb 411->416 417 655c63a4-655c63ae 411->417 423 655c64cd-655c64d7 416->423 424 655c64b0-655c64bf call 655cfec0 416->424 425 655c63cc-655c63db call 655d3ca0 417->425 426 655c63b0-655c63ca call 655d3cd0 free 417->426 427 655c6315-655c6328 call 655c80a0 418->427 428 655c58d2-655c58d9 418->428 421 655c58f7-655c58fd 420->421 422 655c54d0-655c54ef call 655cf210 420->422 432 655c5ac6-655c5ace 421->432 433 655c5903-655c5905 421->433 453 655c54f1-655c5508 PyUnicode_FromFormat 422->453 454 655c5562 422->454 423->426 434 655c64dd 423->434 424->416 449 655c63dd free 425->449 450 655c63e2-655c63ec 425->450 426->425 427->422 428->408 429->430 430->405 432->433 443 655c5ad4-655c5add PyEval_GetFrame 432->443 439 655c5918-655c593c PyUnicode_AsUTF8 433->439 440 655c5907-655c5912 433->440 434->425 447 655c593e-655c5956 439->447 448 655c5958-655c5972 PyImport_GetModuleDict PyDict_GetItem 439->448 440->439 446 655c6199-655c61a3 440->446 451 655c62a6-655c62aa 443->451 452 655c5ae3-655c5b00 443->452 455 655c61a9-655c61b5 446->455 456 655c6306-655c630d 446->456 447->448 457 655c599d-655c59bf PyImport_ExecCodeModuleObject PyErr_Occurred 447->457 448->457 458 655c5974-655c5997 PyModule_GetDict PyDict_GetItemString 448->458 449->450 460 655c63ee free 450->460 461 655c63f3-655c63fd 450->461 451->433 452->433 462 655c5b06-655c5b11 452->462 453->454 463 655c550a-655c5519 Py_DecRef 453->463 459 655c5564-655c5576 454->459 455->406 464 655c61bb-655c61ce call 655c13c0 455->464 456->427 457->422 466 655c59c5-655c59c9 457->466 458->457 465 655c60e5-655c60f7 PyEval_EvalCode 458->465 460->461 467 655c63ff free 461->467 468 655c6404-655c640b 461->468 462->433 463->459 484 655c61d4-655c61f9 PyErr_Format 464->484 485 655c62f7-655c62fe 464->485 469 655c60fd-655c611c Py_DecRef Py_IncRef 465->469 470 655c551b-655c553a call 655cf210 465->470 472 655c59dc-655c59e9 466->472 473 655c59cb-655c59d8 466->473 467->468 474 655c640d free 468->474 475 655c6412-655c641c 468->475 469->459 470->454 487 655c553c-655c5553 PyUnicode_FromFormat 470->487 472->459 473->472 474->475 476 655c641e-655c6422 475->476 477 655c6428-655c642f 475->477 476->477 480 655c64e2-655c64ef _Py_Dealloc 476->480 481 655c643b-655c6445 477->481 482 655c6431-655c6435 477->482 480->482 490 655c64f5 480->490 488 655c6447-655c644b 481->488 489 655c6451-655c6458 481->489 482->481 486 655c6500-655c6510 _Py_Dealloc 482->486 484->422 485->456 486->488 494 655c6516 486->494 487->454 491 655c5555-655c555c Py_DecRef 487->491 488->489 492 655c6520-655c652d _Py_Dealloc 488->492 489->412 493 655c645a-655c6460 489->493 490->481 491->454 492->493 497 655c6533 492->497 495 655c646c-655c6473 493->495 496 655c6462-655c6466 493->496 494->489 499 655c647f-655c6486 495->499 500 655c6475-655c6479 495->500 496->495 498 655c6550-655c655a _Py_Dealloc 496->498 497->412 498->495 502 655c6488-655c648c 499->502 503 655c6492-655c6499 499->503 500->499 501 655c6570-655c657a _Py_Dealloc 500->501 501->499 502->503 504 655c6560-655c656a _Py_Dealloc 502->504 503->412 505 655c649b-655c649f 503->505 504->503 505->412 506 655c6540-655c6547 _Py_Dealloc 505->506 506->498
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyUnicode_AsUTF8.PYTHON311 ref: 655C5924
                                                                                                                                                                                                                              • PyImport_GetModuleDict.PYTHON311 ref: 655C5958
                                                                                                                                                                                                                              • PyDict_GetItem.PYTHON311 ref: 655C5966
                                                                                                                                                                                                                              • PyModule_GetDict.PYTHON311 ref: 655C5977
                                                                                                                                                                                                                              • PyDict_GetItemString.PYTHON311 ref: 655C598A
                                                                                                                                                                                                                              • PyImport_ExecCodeModuleObject.PYTHON311 ref: 655C59AD
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C59B6
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DictDict_Import_ItemModule$CodeErr_ExecModule_ObjectOccurredStringUnicode_
                                                                                                                                                                                                                              • String ID: $%s (%d:%d)$__main__$__mp_main__$__spec__
                                                                                                                                                                                                                              • API String ID: 4088344453-4025645406
                                                                                                                                                                                                                              • Opcode ID: e8e8df76940c80adcfa485fdfe8852c428692b193f4f0e20a05330a4f40e421f
                                                                                                                                                                                                                              • Instruction ID: 50a5a864ebfac76a3046a092d38472960eea4b976405f40bd3b6c9752a3af67e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e8e8df76940c80adcfa485fdfe8852c428692b193f4f0e20a05330a4f40e421f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AD819C3230AB4085EF55CFA9D8983797361FB85F99F9884A9CE6E07754DF29C141C342
                                                                                                                                                                                                                              Function 00007FF61130F3B0 Relevance: 25.8, APIs: 17, Instructions: 341COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 507 7ff61130f3b0-7ff61130f3d7 call 7ff611319288 510 7ff61130f3e9-7ff61130f402 setlocale 507->510 511 7ff61130f3d9-7ff61130f3e5 _strdup 507->511 512 7ff61130f408-7ff61130f411 510->512 513 7ff61130f824-7ff61130f89a wcstombs realloc wcstombs setlocale free 510->513 511->510 512->513 514 7ff61130f417-7ff61130f4ab mbstowcs call 7ff61130f020 mbstowcs 512->514 515 7ff61130f8a1-7ff61130f8a7 513->515 518 7ff61130f4ad-7ff61130f4b8 514->518 519 7ff61130f514-7ff61130f519 514->519 520 7ff61130f4c7-7ff61130f4dc 518->520 521 7ff61130f4ba-7ff61130f4c5 518->521 522 7ff61130f51b-7ff61130f52a 519->522 523 7ff61130f534-7ff61130f53e 519->523 527 7ff61130f4de-7ff61130f4ec 520->527 528 7ff61130f533 520->528 521->519 521->520 522->523 524 7ff61130f52c-7ff61130f531 522->524 525 7ff61130f81a-7ff61130f81d 523->525 526 7ff61130f544-7ff61130f554 523->526 524->523 525->513 529 7ff61130f5aa-7ff61130f5b4 526->529 527->528 530 7ff61130f4ee-7ff61130f50f setlocale free 527->530 528->523 531 7ff61130f556-7ff61130f561 529->531 532 7ff61130f5b6 529->532 533 7ff61130f81f-7ff61130f822 530->533 534 7ff61130f577-7ff61130f582 531->534 535 7ff61130f563-7ff61130f56e 531->535 536 7ff61130f5b9-7ff61130f5c1 532->536 533->515 541 7ff61130f572 534->541 542 7ff61130f584-7ff61130f58f 534->542 539 7ff61130f570 535->539 540 7ff61130f5a5 535->540 537 7ff61130f5c8-7ff61130f5d5 536->537 538 7ff61130f5c3-7ff61130f76c 536->538 544 7ff61130f5d7-7ff61130f5e2 537->544 545 7ff61130f5f1-7ff61130f5f9 537->545 552 7ff61130f77b-7ff61130f780 538->552 553 7ff61130f76e-7ff61130f779 538->553 539->534 540->529 541->534 542->541 546 7ff61130f591-7ff61130f59b 542->546 544->537 547 7ff61130f5e4-7ff61130f5ef 544->547 548 7ff61130f5fb-7ff61130f606 545->548 549 7ff61130f653-7ff61130f669 545->549 550 7ff61130f5b8 546->550 551 7ff61130f59d-7ff61130f5a1 546->551 547->537 547->545 555 7ff61130f608-7ff61130f613 548->555 556 7ff61130f615-7ff61130f62a 548->556 557 7ff61130f670-7ff61130f67b 549->557 550->536 551->540 554 7ff61130f793-7ff61130f7f2 wcstombs realloc wcstombs 552->554 553->552 558 7ff61130f782-7ff61130f78e 553->558 559 7ff61130f7f7-7ff61130f818 setlocale free 554->559 555->549 555->556 556->549 560 7ff61130f62c-7ff61130f63b 556->560 561 7ff61130f66b 557->561 562 7ff61130f67d-7ff61130f688 557->562 558->554 559->533 560->549 564 7ff61130f63d-7ff61130f64c 560->564 561->557 562->561 563 7ff61130f68a-7ff61130f696 562->563 565 7ff61130f698-7ff61130f6aa 563->565 566 7ff61130f6ac-7ff61130f6b0 563->566 564->549 567 7ff61130f64e 564->567 565->566 568 7ff61130f6b4-7ff61130f6bc 565->568 566->568 567->549 569 7ff61130f713-7ff61130f71d 568->569 570 7ff61130f6be-7ff61130f6db 569->570 571 7ff61130f71f-7ff61130f748 wcstombs 569->571 572 7ff61130f6f9-7ff61130f704 570->572 573 7ff61130f6dd-7ff61130f6f0 570->573 571->559 574 7ff61130f74e-7ff61130f75c 571->574 576 7ff61130f706-7ff61130f711 572->576 577 7ff61130f6f4 572->577 573->569 575 7ff61130f6f2 573->575 574->559 575->572 576->569 576->577 577->572
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcstombs$setlocale$free$mbstowcsrealloc$_strdup
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 918573998-0
                                                                                                                                                                                                                              • Opcode ID: bc37caea81c3f1b4857c0da5a89418885bf617b27b1e748d0f14d2c635658186
                                                                                                                                                                                                                              • Instruction ID: 8f5bee2cb25e0e19cbce18612337648e828bf28c2b5ca53fac248c82cb0a813c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bc37caea81c3f1b4857c0da5a89418885bf617b27b1e748d0f14d2c635658186
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 65F1F866F04B1989EB509BAAD4412BC27F9FB48FA8F804436DE4CA7798EF38D451C351
                                                                                                                                                                                                                              Function 00007FF611301710 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 231fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 726 7ff611301710-7ff61130177d call 7ff61130a920 729 7ff611301783-7ff611301793 malloc 726->729 730 7ff611301a58-7ff611301a70 call 7ff611302e60 726->730 731 7ff611301799-7ff6113017a9 malloc 729->731 732 7ff611301ab7-7ff611301ace call 7ff611302fe0 729->732 744 7ff611301a75-7ff611301a93 730->744 735 7ff6113017af-7ff6113017cd 731->735 736 7ff611301a98-7ff611301aaa call 7ff611302fe0 731->736 741 7ff611301aaf 732->741 739 7ff6113017d5-7ff6113017f7 fread 735->739 736->741 742 7ff611301a30-7ff611301a39 739->742 743 7ff6113017fd-7ff611301807 ferror 739->743 741->732 748 7ff611301a41-7ff611301a53 742->748 743->742 745 7ff61130180d-7ff61130182e 743->745 746 7ff6113019d0-7ff6113019d8 744->746 749 7ff611301831-7ff61130184d call 7ff61130a9d0 745->749 747 7ff611301928-7ff61130192a 746->747 747->749 752 7ff611301930-7ff611301951 747->752 750 7ff61130187f-7ff611301892 call 7ff611302e60 748->750 757 7ff61130184f-7ff611301852 749->757 758 7ff611301868-7ff61130186b 749->758 764 7ff611301897-7ff6113018c4 call 7ff61130c780 free * 2 750->764 754 7ff611301ad0-7ff611301adb 752->754 755 7ff611301957-7ff61130195a 752->755 755->739 759 7ff611301960-7ff611301977 755->759 761 7ff611301854-7ff611301863 757->761 762 7ff6113018c8-7ff6113018e1 757->762 758->762 765 7ff61130186d-7ff61130187c 758->765 763 7ff61130197d 759->763 759->764 761->750 767 7ff611301988-7ff611301991 762->767 768 7ff6113018e7-7ff611301909 fwrite 762->768 763->750 765->750 767->747 771 7ff611301993-7ff611301997 767->771 768->748 770 7ff61130190f-7ff61130191e ferror 768->770 770->748 772 7ff611301924 770->772 773 7ff6113019e0-7ff611301a26 771->773 774 7ff611301999-7ff61130199d 771->774 772->747 773->746 774->744 775 7ff6113019a3-7ff6113019a6 774->775 775->746 776 7ff6113019a8-7ff6113019b9 775->776 776->746 777 7ff6113019bb-7ff6113019cf 776->777 777->746
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc$ferrorfree$freadfwrite
                                                                                                                                                                                                                              • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                              • API String ID: 1635854594-1655038675
                                                                                                                                                                                                                              • Opcode ID: 99619c3a175132b3582db99fac23658321bec914c492db8dc182f7a91b5b4957
                                                                                                                                                                                                                              • Instruction ID: 0f5177cb95451457f0e952c0fc06814180a0d22c16884b2a576d92242c99b95f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99619c3a175132b3582db99fac23658321bec914c492db8dc182f7a91b5b4957
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8791CF22B08A9641E7208F12A8403BA66E8BB45FF4F544231DE9DD3BDDEE7CE585D700
                                                                                                                                                                                                                              Function 00007FF6113016D0 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 342stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 778 7ff6113016d0-7ff611303ce3 call 7ff611308fe0 call 7ff61130f020 call 7ff6113021d0 786 7ff611304070 778->786 787 7ff611303ce9-7ff611303cfc call 7ff6113045a0 778->787 790 7ff611304080-7ff61130409b call 7ff6113022c0 786->790 787->786 791 7ff611303d02-7ff611303d17 call 7ff611304620 787->791 796 7ff61130409d-7ff6113040ae 790->796 797 7ff611304056-7ff611304068 call 7ff611302e60 790->797 791->786 799 7ff611303d1d-7ff611303d32 call 7ff611307e30 791->799 800 7ff611304100-7ff61130411c call 7ff611309090 796->800 801 7ff6113040b0-7ff6113040ba 796->801 797->786 814 7ff611303e00-7ff611303e18 call 7ff611307f20 call 7ff6113022c0 799->814 815 7ff611303d38-7ff611303d4a call 7ff611307e30 799->815 812 7ff6113042a5-7ff6113042b1 call 7ff611302e60 800->812 813 7ff611304122-7ff611304130 SetDllDirectoryW call 7ff611307020 800->813 805 7ff6113040c0-7ff6113040dc call 7ff611309090 801->805 806 7ff611304228-7ff611304233 call 7ff6113024a0 801->806 805->812 820 7ff6113040e2-7ff6113040f5 SetDllDirectoryW call 7ff611307020 805->820 806->805 819 7ff611304239 806->819 812->786 837 7ff611304140-7ff611304155 call 7ff611304650 813->837 840 7ff611304040-7ff611304050 call 7ff6113022c0 814->840 841 7ff611303e1e-7ff611303e34 814->841 828 7ff611303d50-7ff611303d58 815->828 829 7ff611303f38-7ff611303f49 call 7ff611307f20 call 7ff6113022c0 815->829 819->786 834 7ff611303e63-7ff611303e70 call 7ff611306b90 820->834 832 7ff611303d5e-7ff611303d87 free call 7ff611307f20 * 2 call 7ff6113022c0 828->832 833 7ff611303f28 828->833 857 7ff611303f4e-7ff611303f50 829->857 832->790 890 7ff611303d8d-7ff611303d9e 832->890 833->829 853 7ff611304000-7ff61130400f call 7ff611306d80 834->853 854 7ff611303e76-7ff611303e83 call 7ff611307060 834->854 858 7ff61130415b-7ff6113041a1 call 7ff611308bb0 837->858 859 7ff611304208 837->859 840->797 840->837 847 7ff611303f70 841->847 848 7ff611303e3a-7ff611303e45 call 7ff6113024a0 841->848 851 7ff611303f78-7ff611303f7f 847->851 848->786 874 7ff611303e4b-7ff611303e53 848->874 869 7ff611303f90-7ff611303f9f call 7ff6113036c0 851->869 878 7ff611304023-7ff611304037 call 7ff6113071c0 call 7ff611307060 853->878 879 7ff611304011-7ff61130401d call 7ff611306fa0 853->879 854->869 880 7ff611303e89-7ff611303e9a strcmp 854->880 865 7ff6113041f8 857->865 866 7ff611303f56-7ff611303f5d 857->866 875 7ff611304292-7ff6113042a0 fclose 858->875 876 7ff6113041a7-7ff6113041bf 858->876 863 7ff61130420e-7ff61130421d call 7ff611302e60 859->863 863->786 865->859 866->847 869->786 894 7ff611303fa5-7ff611303fea call 7ff611307ec0 call 7ff611303c70 call 7ff611308820 call 7ff6113071c0 call 7ff611307060 869->894 874->847 883 7ff611303e59-7ff611303e5e call 7ff611307020 874->883 875->863 876->851 885 7ff6113041c5-7ff6113041da call 7ff6113024a0 876->885 878->840 879->878 904 7ff611304280-7ff61130428d call 7ff6113072d0 879->904 888 7ff611303ede-7ff611303ee9 call 7ff611303bf0 call 7ff611303c00 880->888 889 7ff611303e9c-7ff611303ebf call 7ff611303c80 880->889 883->834 885->786 910 7ff6113041e0-7ff6113041e8 885->910 917 7ff611303eee-7ff611303f07 call 7ff611303c60 call 7ff6113071c0 call 7ff611307060 888->917 889->786 914 7ff611303ec5-7ff611303ed9 strcpy 889->914 897 7ff611303da4 890->897 898 7ff611304250-7ff61130425a 890->898 943 7ff611304240-7ff611304248 call 7ff611308260 894->943 944 7ff611303ff0-7ff611303ff8 call 7ff611302210 894->944 906 7ff611303daa-7ff611303dd0 call 7ff611309090 897->906 898->805 902 7ff611304260-7ff61130426b call 7ff6113024a0 898->902 902->906 924 7ff611304271 902->924 904->875 906->812 926 7ff611303dd6-7ff611303ddf SetDllDirectoryW call 7ff611307020 906->926 910->883 918 7ff6113041ee 910->918 914->888 941 7ff611303f0c-7ff611303f21 917->941 918->851 924->786 930 7ff611303de4-7ff611303dec 926->930 930->834 933 7ff611303dee-7ff611303df8 call 7ff611307060 930->933 933->880 943->898 944->941
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$DirectoryEnvironmentVariablecalloc$ByteCharFileModuleMultiNameWidestrcmpstrcpy
                                                                                                                                                                                                                              • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                              • API String ID: 2187479179-3096095006
                                                                                                                                                                                                                              • Opcode ID: 77efaa2d4623c45b5b74c92c9212e285a0ec3a2d66ca2dbf9d5886927e4342f2
                                                                                                                                                                                                                              • Instruction ID: 0e977f339c364287317b8045a5fd6242561dea83be5132dfacc858a02cdec789
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77efaa2d4623c45b5b74c92c9212e285a0ec3a2d66ca2dbf9d5886927e4342f2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6E18F21A0CE4280EB64EB22A9502BB66EDAF44FE0F444135EE4ED77DEDE3CE5058750
                                                                                                                                                                                                                              Function 00007FF611301F90 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 132COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freadmalloc$_wfopenfclosefree
                                                                                                                                                                                                                              • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 2617120823-2084260460
                                                                                                                                                                                                                              • Opcode ID: 97e34f1f8197036ee463dd14bcf40f542b76db0e688edaab6505a5423c5ed9ce
                                                                                                                                                                                                                              • Instruction ID: 6a7e4713da0cd09ce4828a6ce8d251fee3b1e603478eb1b654140d261a6bc9f9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 97e34f1f8197036ee463dd14bcf40f542b76db0e688edaab6505a5423c5ed9ce
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33516C71B09E0682EB189B29D8442B867F9AF88FA4F54823AD90DC779DDF3CE505C744
                                                                                                                                                                                                                              Function 6563F450 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 123fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 988 6563f450-6563f468 989 6563f4a2-6563f4a5 988->989 990 6563f46a-6563f47c 988->990 993 6563f4a7-6563f4b9 _errno 989->993 991 6563f482-6563f484 990->991 992 6563f590-6563f592 990->992 996 6563f5b0-6563f5b2 991->996 997 6563f48a-6563f492 991->997 994 6563f5c4-6563f5cf 992->994 995 6563f594-6563f5a5 992->995 998 6563f570-6563f579 _errno 993->998 999 6563f4bf-6563f4c3 993->999 994->993 995->993 1001 6563f5b4-6563f5ba 996->1001 1002 6563f608-6563f60d 996->1002 1003 6563f494-6563f49b 997->1003 1004 6563f49d-6563f4a0 997->1004 1000 6563f57f-6563f58e 998->1000 999->998 1005 6563f4c9-6563f4cc 999->1005 1001->994 1003->993 1003->1004 1004->993 1005->998 1006 6563f4d2-6563f4dd 1005->1006 1007 6563f4e3-6563f511 CreateFileMappingA 1006->1007 1008 6563f5d4-6563f5e8 _get_osfhandle 1006->1008 1010 6563f513-6563f546 MapViewOfFile CloseHandle 1007->1010 1011 6563f548-6563f56a GetLastError _errno 1007->1011 1008->1007 1009 6563f5ee-6563f603 _errno 1008->1009 1009->1000 1010->1000 1010->1011
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: File_errno$CloseCreateErrorHandleLastMappingView
                                                                                                                                                                                                                              • String ID: $@$@
                                                                                                                                                                                                                              • API String ID: 896588047-3743272326
                                                                                                                                                                                                                              • Opcode ID: fba389cb87774ad06a68b5533d78d5babd8062efa688bd72495702a505ed211f
                                                                                                                                                                                                                              • Instruction ID: 5da0bf4e5e469521b86c516d5549271f50203570b2081865e894b15c02e9722b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fba389cb87774ad06a68b5533d78d5babd8062efa688bd72495702a505ed211f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 34411573F15A6045E7218F16ED41B4AA155BB55BB9F492331EE7A17BE1EB3CC840C340
                                                                                                                                                                                                                              Function 00007FF611301B30 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 89COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _wfopenfclosefreadfreemalloc
                                                                                                                                                                                                                              • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$_MEIPASS2$fread$fseek$malloc
                                                                                                                                                                                                                              • API String ID: 3354994319-975985129
                                                                                                                                                                                                                              • Opcode ID: fb8e1b4c3ae1c0d9dbf1886b60f8a5d38b6fdbff1d087ba08816e469a5146e79
                                                                                                                                                                                                                              • Instruction ID: 19ba8768eb761e48cedd2b0abc945a7dccd61e1ec89d696ce9ab765ff50e25e5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fb8e1b4c3ae1c0d9dbf1886b60f8a5d38b6fdbff1d087ba08816e469a5146e79
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9319E51B09E1B51FF19A7119854AFA12ACAF14FF8F844036EC0DC769EEE6CE50AC300
                                                                                                                                                                                                                              Function 00007FF611306450 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 122COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocfflush$strcmpstrncmp
                                                                                                                                                                                                                              • String ID: Failed to allocate PyConfig structure! Unsupported python version?$Failed to parse run-time options!$Failed to pre-initialize embedded python interpreter!$Failed to set module search paths!$Failed to set program name!$Failed to set python home path!$Failed to set run-time options!$Failed to set sys.argv!$Failed to start embedded python interpreter!
                                                                                                                                                                                                                              • API String ID: 2710203250-3807717293
                                                                                                                                                                                                                              • Opcode ID: 20069458dbc6cbfea570bcd6b724cb1ff9c6197de144f72581953467c1bf7855
                                                                                                                                                                                                                              • Instruction ID: 1117b7a542243e7d961cb3f266d51af83b42f4c675e4a000774ed07a24314ea8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20069458dbc6cbfea570bcd6b724cb1ff9c6197de144f72581953467c1bf7855
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B051F850A0CE5781FB15AB29E8551B953EDAF80FF4F541132EE4EC62EEEE2DE9059300
                                                                                                                                                                                                                              Function 655DF060 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 455COMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 1108 655df060-655df07a 1109 655df4dc-655df52e call 655dd200 1108->1109 1110 655df080-655df083 1108->1110 1120 655df6e5-655df6f9 call 655dd200 1109->1120 1121 655df534-655df537 1109->1121 1111 655df089-655df095 1110->1111 1112 655df4c3-655df4d7 call 655dd200 1110->1112 1114 655df09b-655df0d8 call 655e0d10 1111->1114 1115 655df4aa-655df4be call 655dd200 1111->1115 1112->1109 1122 655df0dd-655df0e1 1114->1122 1115->1112 1129 655df6fe-655df712 call 655dd200 1120->1129 1124 655df53d-655df540 1121->1124 1125 655df6cc-655df6e0 call 655dd200 1121->1125 1126 655df0f5-655df10e calloc 1122->1126 1127 655df0e3-655df0f4 1122->1127 1124->1129 1130 655df546-655df54e 1124->1130 1125->1120 1131 655df114-655df14c call 655e1dc0 1126->1131 1132 655df252-655df299 call 655e0f30 1126->1132 1139 655df717-655df731 1129->1139 1134 655df560-655df563 1130->1134 1135 655df550-655df55f 1130->1135 1144 655df14e-655df1a6 call 655e1c50 1131->1144 1145 655df1c0-655df1fa call 655e1c50 1131->1145 1152 655df2a0-655df2ad 1132->1152 1134->1135 1136 655df565-655df56e call 655e1170 1134->1136 1136->1135 1150 655df570-655df5a4 call 655e0d10 1136->1150 1147 655df737-655df74f 1139->1147 1148 655df626-655df65c call 655e0f30 1139->1148 1161 655df209 1144->1161 1162 655df1a8 1144->1162 1145->1152 1158 655df200-655df203 1145->1158 1147->1148 1164 655df755-655df799 call 655e0d10 1147->1164 1172 655df665-655df67c 1148->1172 1150->1135 1166 655df5a6-655df5b6 1150->1166 1168 655df420-655df430 1152->1168 1169 655df2b3-655df2c4 1152->1169 1158->1152 1158->1161 1165 655df20b-655df24d call 655e0f30 1161->1165 1167 655df1ae-655df1b6 free 1162->1167 1179 655df7a9-655df7b9 call 655e44c0 1164->1179 1180 655df79b-655df7a7 1164->1180 1165->1167 1166->1148 1181 655df5b8-655df5ba 1166->1181 1167->1127 1182 655df43c-655df48f call 655e1c50 1168->1182 1183 655df432-655df437 1168->1183 1169->1165 1178 655df2ca-655df40a call 655e1c50 1169->1178 1172->1148 1189 655df67e-655df69b 1172->1189 1195 655df49a-655df4a5 1178->1195 1196 655df410-655df415 1178->1196 1179->1148 1180->1179 1198 655df7be-655df7d3 1180->1198 1187 655df610-655df624 call 655e0fe0 1181->1187 1182->1161 1199 655df495 1182->1199 1183->1165 1187->1148 1202 655df5c0-655df5d7 1187->1202 1189->1148 1201 655df69d-655df6af 1189->1201 1195->1167 1196->1165 1198->1179 1208 655df7d5-655df7eb 1198->1208 1199->1195 1201->1139 1209 655df6b1-655df6c5 call 655e0fe0 1201->1209 1202->1148 1210 655df5d9-655df5f6 1202->1210 1208->1179 1213 655df7ed-655df804 1208->1213 1209->1172 1217 655df6c7 1209->1217 1210->1148 1216 655df5f8-655df60a 1210->1216 1213->1179 1220 655df806-655df820 1213->1220 1216->1187 1216->1209 1217->1148 1220->1179 1222 655df822-655df83a 1220->1222 1222->1179 1224 655df840-655df85b 1222->1224 1224->1179 1226 655df861-655df877 1224->1226 1226->1179 1228 655df87d-655df88b 1226->1228 1228->1179 1230 655df891-655df89f 1228->1230 1230->1179 1232 655df8a5-655df8ac 1230->1232 1232->1148
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocfree
                                                                                                                                                                                                                              • String ID: in != NULL$key != NULL$key != NULL$ltc_mp.name != NULL$ltc_mp.name != NULL$size > 0$src/pk/rsa/rsa_import.c$src/pk/rsa/rsa_make_key.c
                                                                                                                                                                                                                              • API String ID: 306872129-2031961738
                                                                                                                                                                                                                              • Opcode ID: 66a0225e8378a90f5104ae6bb13b2583ae0a41954c2b1ea464cda92131a1ee8c
                                                                                                                                                                                                                              • Instruction ID: d309e945b13ff7d4a5fe46c71a816498b6b57d31c09cb3b5b8e82738f3b63150
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 66a0225e8378a90f5104ae6bb13b2583ae0a41954c2b1ea464cda92131a1ee8c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F9123B77208B8186E760CF66E84879AB7A5F784BC8F004116EF8A87B58DF79C495CB44
                                                                                                                                                                                                                              Function 655DBF20 Relevance: 14.7, APIs: 4, Strings: 5, Instructions: 1167COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: a != NULL$b != NULL$c != NULL$d != NULL$src/math/tfm_desc.c
                                                                                                                                                                                                                              • API String ID: 0-1480740242
                                                                                                                                                                                                                              • Opcode ID: 7c7bd4ba0b3e25ae8a6753b3d7c54dee5c41c578796af4c7dccc66bdf6b24d26
                                                                                                                                                                                                                              • Instruction ID: 4f28f6b21660ea1bc6565a7366adf57d69a78a845c566b27ad74431eaf7f54df
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c7bd4ba0b3e25ae8a6753b3d7c54dee5c41c578796af4c7dccc66bdf6b24d26
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD921663B1190195FF04DBACDD483B9A2B2FB95385FC0D615DD1A83750EB2EC296CB84
                                                                                                                                                                                                                              Function 00007FF611306640 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 102stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule

                                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                                              control_flow_graph 1736 7ff611306640-7ff611306683 strlen 1738 7ff611306799-7ff6113067a5 call 7ff611302e60 1736->1738 1739 7ff611306689-7ff6113066a1 1736->1739 1745 7ff611306770-7ff611306781 1738->1745 1743 7ff611306788-7ff611306798 1739->1743 1744 7ff6113066a7-7ff6113066bc 1739->1744 1746 7ff6113066fb-7ff611306704 1744->1746 1747 7ff6113066e3-7ff6113066f5 call 7ff611301b20 1746->1747 1748 7ff611306706-7ff611306726 call 7ff611301b30 1746->1748 1747->1743 1747->1746 1754 7ff611306733-7ff61130674e call 7ff611302e60 1748->1754 1755 7ff611306728 1748->1755 1762 7ff611306750-7ff611306762 1754->1762 1763 7ff611306768-7ff61130676b free 1754->1763 1757 7ff61130672e-7ff611306731 1755->1757 1757->1754 1759 7ff6113066c0-7ff6113066c7 1757->1759 1764 7ff6113066db-7ff6113066de free 1759->1764 1765 7ff6113066c9-7ff6113066d2 1759->1765 1762->1763 1763->1745 1764->1747 1765->1764
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freestrlen
                                                                                                                                                                                                                              • String ID: Failed to get _MEIPASS as PyObject.$Module object for %s is NULL!$_MEIPASS$_MEIPASS2$strict$utf-8
                                                                                                                                                                                                                              • API String ID: 322734593-568040347
                                                                                                                                                                                                                              • Opcode ID: c86c3118278ee8bfe6f245b6e564e2c1b0f4dc624b45d7fcaba12a39e257e185
                                                                                                                                                                                                                              • Instruction ID: 7bcf295ad4f60ec43ae5b7e1d170a4cc9280a7ab8b1c0b0d48950769be05d882
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c86c3118278ee8bfe6f245b6e564e2c1b0f4dc624b45d7fcaba12a39e257e185
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 64414166A19E0681EB15AB22E81407963A9BF45FF0B484031DE1DC73A8EF3CE446D340
                                                                                                                                                                                                                              Function 00007FF611308BB0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freemalloc
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 3061335427-3944641314
                                                                                                                                                                                                                              • Opcode ID: bdde55cfa16026eebf9a339662736028ea2731d0b4dd98c6b30f895782374b5d
                                                                                                                                                                                                                              • Instruction ID: 31d736820ee6db04093ef4c6f9896fd2b50ee26e50706fd6a4c1a1260301bf2d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bdde55cfa16026eebf9a339662736028ea2731d0b4dd98c6b30f895782374b5d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C21B012B5AD5681FF11DA2299047FAD6A96F45FE8F880471DE0CCB68AEE3DE542C200
                                                                                                                                                                                                                              Function 00007FF611307020 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 14COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: calloc
                                                                                                                                                                                                                              • String ID: Cannot allocate memory for SPLASH_STATUS.$calloc
                                                                                                                                                                                                                              • API String ID: 2635317215-799113134
                                                                                                                                                                                                                              • Opcode ID: f2af3c9f5e49862c4fdb12449ad5d52b59e493735a903b8862745a60d1d68c81
                                                                                                                                                                                                                              • Instruction ID: a4db885e7fb9adeb9a252c813abdb801886f8b64749be8aa9518b9d365af448b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f2af3c9f5e49862c4fdb12449ad5d52b59e493735a903b8862745a60d1d68c81
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BBE01265E08E0280EF159710A4511B923A8FF85BA4F944138DA4CC77EDED3CE545CB84
                                                                                                                                                                                                                              Function 00007FF6113022C0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 93stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcpy
                                                                                                                                                                                                                              • String ID: pyi-contents-directory
                                                                                                                                                                                                                              • API String ID: 3177657795-2617349511
                                                                                                                                                                                                                              • Opcode ID: 5bf9b9d7ed3ee3d6fd6229c4798420956e625b75858e8fae20c676d5f28f119e
                                                                                                                                                                                                                              • Instruction ID: beb355618fcbd02f6dbb066d42b8b7063f3f3d2d4380c325e3a1015924a389ef
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bf9b9d7ed3ee3d6fd6229c4798420956e625b75858e8fae20c676d5f28f119e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA318362B09E8284FB619A65E8083F91399AF44FE4F484131ED0DCB78EDE3CE545C710
                                                                                                                                                                                                                              Function 00007FF611310060 Relevance: 3.1, APIs: 2, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fsetpos
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 850078086-0
                                                                                                                                                                                                                              • Opcode ID: 465717a23ec0afd49ac1cc4503031fffc665e619fc2808689674e9d738e7ebcb
                                                                                                                                                                                                                              • Instruction ID: 8fbe51eea9154128745f2afa209e5bb9ad3423301091d52a15b8e6968331372a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 465717a23ec0afd49ac1cc4503031fffc665e619fc2808689674e9d738e7ebcb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD113376F04F469AEB109F7588450AC33B8AB09BA8F504A35EE5D8779DDF38D1918350
                                                                                                                                                                                                                              Function 00007FF6113087C0 Relevance: 3.0, APIs: 2, Instructions: 20libraryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              • LoadLibraryExW.KERNEL32 ref: 00007FF6113087E1
                                                                                                                                                                                                                              • free.MSVCRT ref: 00007FF6113087ED
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharLibraryLoadMultiWidefree
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3231889924-0
                                                                                                                                                                                                                              • Opcode ID: 535df131c80773ec3641a450554190b52356524c405bfe3dafee0d4a050d7bfd
                                                                                                                                                                                                                              • Instruction ID: de2bf407348129cdc7b76e2490877ad15588131068c4672d58f9951828f273ec
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 535df131c80773ec3641a450554190b52356524c405bfe3dafee0d4a050d7bfd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BAD05E11F2A57A01EF98B3773C1A6A611991F8DFF0E889434DC0D8B749FC2D95828740
                                                                                                                                                                                                                              Function 00007FF61130FF1B Relevance: 2.6, APIs: 2, Instructions: 67COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freememsetwcslen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2332356550-0
                                                                                                                                                                                                                              • Opcode ID: c2e1b32b20ba580d70b52182103e0aee796dda81a15ec91a94acdf2495544fb0
                                                                                                                                                                                                                              • Instruction ID: c57a86ef9d78d6b86cf63e6b8d1460ce5ac0b377950596c0c4f38e4305235a93
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c2e1b32b20ba580d70b52182103e0aee796dda81a15ec91a94acdf2495544fb0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BE31B466B04B1489EB14CF7AD48109C3BB5FB98BA8B108526EE1C57B6CEB38C591C790
                                                                                                                                                                                                                              Function 65640AD0 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 544645111-0
                                                                                                                                                                                                                              • Opcode ID: 4f343b87695161a5d18254556ffb36e1b7b87a5952e54c1e2f269dc1fb69e6c3
                                                                                                                                                                                                                              • Instruction ID: d99ca083c67c347cd19ee18d55c82c78793cd12b79b1ca4db7d4a6c713e6bf4b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f343b87695161a5d18254556ffb36e1b7b87a5952e54c1e2f269dc1fb69e6c3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24F01C6037D53085EB318539CB20F9679516723BBDF60C106D9661EEA0D56BC285CF0A
                                                                                                                                                                                                                              Function 00007FF611304650 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              • _wfopen.MSVCRT ref: 00007FF611304695
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide_wfopen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 372205238-0
                                                                                                                                                                                                                              • Opcode ID: 8e21174acb464d8d1757056906152d011765c52c98c26f0b73aa27ab55bd4878
                                                                                                                                                                                                                              • Instruction ID: 6b06dd2b62576c8f81ae7b8d371d63d0cc2b2708278ba82037bfd7d4375f0b85
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8e21174acb464d8d1757056906152d011765c52c98c26f0b73aa27ab55bd4878
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 90E09251B0861041EA14A222A9143E9829A6F49FE0F448030EE0C9BB8E9D1DD2438701
                                                                                                                                                                                                                              Function 00007FFD930B2B53 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3978063606-0
                                                                                                                                                                                                                              • Opcode ID: 7a7abb42e1da2373a447522d0703c239a0e1054588c5a2e88d83da34d31c41e1
                                                                                                                                                                                                                              • Instruction ID: 2424605fa26b5d053d7b12a72e659be14e01e7d936ba5157a17ceeea092ec2bf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a7abb42e1da2373a447522d0703c239a0e1054588c5a2e88d83da34d31c41e1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8C01265F4500387FB1827798C7626911595F44710FD08038F10ED27D0CD0C58599700
                                                                                                                                                                                                                              Function 6563DB10 Relevance: 1.5, APIs: 1, Instructions: 213COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memset
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2221118986-0
                                                                                                                                                                                                                              • Opcode ID: 39845fe85abc8515df8a10b1327270222ed7b3955be2a785a19ce327db88efc3
                                                                                                                                                                                                                              • Instruction ID: 132fbdd26fff374f7cf2d351cad36bb92939a0d2f90e5bbda1858fdc9c0c2c88
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 39845fe85abc8515df8a10b1327270222ed7b3955be2a785a19ce327db88efc3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F191CAB2605BA482EB548F26D0523993BB5F705FDCF18611ACE9E1BB99CB38C495C380
                                                                                                                                                                                                                              Function 00007FF61130D990 Relevance: 1.3, APIs: 1, Instructions: 76COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memset
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2221118986-0
                                                                                                                                                                                                                              • Opcode ID: a1c7189d00abfc9b8276c972b3be7d95addfd7c87cd30e887ec7055d5bdc4fb6
                                                                                                                                                                                                                              • Instruction ID: 63dee087bdf0a544bbbe868f2dc468b06e5b9f19f7c972023103ac7626a25950
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a1c7189d00abfc9b8276c972b3be7d95addfd7c87cd30e887ec7055d5bdc4fb6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6131F326F08B1599FB109BA6D4443BC37F8A704BA8F904076DE8CA7B98DF3C9691C754
                                                                                                                                                                                                                              Function 00007FF61130A920 Relevance: 1.3, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2803490479-0
                                                                                                                                                                                                                              • Opcode ID: 70144d6ec82bfe141b5cbf93c26a1062560a1e9f03a4e2e5c767b20eb75f5ad6
                                                                                                                                                                                                                              • Instruction ID: 36b0b58fb2304a27edfa2adfe9f5b024120aca135dc81ba736022c0fecf52110
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 70144d6ec82bfe141b5cbf93c26a1062560a1e9f03a4e2e5c767b20eb75f5ad6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0216D22B09E0686EB614B19A4403393AD9AB44FF4F294334C94EC73D8DF39D983D340
                                                                                                                                                                                                                              Function 6563DF90 Relevance: 1.3, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • malloc.MSVCRT(?,?,00000000,?,65620E00,00000000,?,?,655D3D06,?,?,?,?,?,?), ref: 6563DF9F
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2803490479-0
                                                                                                                                                                                                                              • Opcode ID: 6d5a5068f8737ec916e8a16d7766cd4028a32b3106eec7618bac94735153682a
                                                                                                                                                                                                                              • Instruction ID: ecd2a7cf14ba2ba2ec5fba9e668081c644534c6d0695b4bcd49c0b1cf6bf393d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d5a5068f8737ec916e8a16d7766cd4028a32b3106eec7618bac94735153682a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 17D02262B87A5081C50C8B577C402988282275EBE0E48C4308E4C87304EC280093C300
                                                                                                                                                                                                                              Function 6563E010 Relevance: 1.3, APIs: 1, Instructions: 11COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1294909896-0
                                                                                                                                                                                                                              • Opcode ID: 59eabad26ca4bc0f09825227a2a1e64669a24db1d1228eb4b05c6605dca3421f
                                                                                                                                                                                                                              • Instruction ID: 0461b1dea6cc65391c1b5cd92fb44d3b9dee5cc20ee36312cf4eed87a31d761c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59eabad26ca4bc0f09825227a2a1e64669a24db1d1228eb4b05c6605dca3421f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 50C08CA6A02A00C2FF094BA2F85133422A0AB6CF06F285040CE2A46301DB2C48B4C310

                                                                                                                                                                                                                              Non-executed Functions

                                                                                                                                                                                                                              Function 655D3480 Relevance: 72.1, APIs: 35, Strings: 6, Instructions: 355networkstringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorLast$ioctlsockettoupper$Cleanupstrstr$closesocketgethostbynamememcmp$Startup_mktime64connecthtonsrecvselectsendsocketstrchr
                                                                                                                                                                                                                              • String ID: Dec$HEAD /%s HTTP/1.1Host: %sUser-Agent: PYARMOR.COREConnection: close$Nov$and,$http://$or,
                                                                                                                                                                                                                              • API String ID: 3493847099-1714119496
                                                                                                                                                                                                                              • Opcode ID: 9afb767975e33e2b9d9cd3452f2ed2fc400f48b80fcd6c6cddda133a68a5f2c0
                                                                                                                                                                                                                              • Instruction ID: 3896cd6c530369e2d64b8908d9846f8f6c076cce19ba745327b2dd297dd88c35
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9afb767975e33e2b9d9cd3452f2ed2fc400f48b80fcd6c6cddda133a68a5f2c0
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 98E12673708AC186E710CF28E84875EBBB1F345B99F458325CA664BB98EB3DC14AC745
                                                                                                                                                                                                                              Function 655D4710 Relevance: 63.4, APIs: 30, Strings: 6, Instructions: 406memorystringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Process$AdaptersAddressesAllocComputerFreeNamemallocstrlen
                                                                                                                                                                                                                              • String ID: 01234567$89abcdef$:[sc$Characteristics$NetCfgInstanceId$SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}
                                                                                                                                                                                                                              • API String ID: 1478035857-3618987999
                                                                                                                                                                                                                              • Opcode ID: a2a06f18a30ccc7ce6431cacb19e7b6ddc4f54a7aadf24aaca0f3f9b0134f156
                                                                                                                                                                                                                              • Instruction ID: 6498aeac7ebd99c4eced5d86e7b2689e047e60fb84f52bd37c6f5930d0dc038e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a2a06f18a30ccc7ce6431cacb19e7b6ddc4f54a7aadf24aaca0f3f9b0134f156
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 51F17F73319B90C6EB20CB1AB844B9BB7A6F785B84F448225DEC947B58DB7DC005CB49
                                                                                                                                                                                                                              Function 00007FF611307F60 Relevance: 49.2, APIs: 20, Strings: 8, Instructions: 188COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$CreateDirectoryEnvironment$ByteCharExpandMultiPathStringsTempVariableWide_getpid_wcsdup_wfullpath_wputenv_s_wtempnamwcschrwcslen
                                                                                                                                                                                                                              • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.$LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 2274789544-3119237222
                                                                                                                                                                                                                              • Opcode ID: 3b840c5506bd6fd7349de0f788188c7a37745e8f39f2dcd91eb27e463c901c61
                                                                                                                                                                                                                              • Instruction ID: 727f2a12e79b7da31d9e4b5a610f38af72b660992e3f0f6dfc138cee1b0007ad
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3b840c5506bd6fd7349de0f788188c7a37745e8f39f2dcd91eb27e463c901c61
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 62612A21F49E5681FB59BB66A8192BA52E9AF49FE0F484431DD0ED778EED2CE405C300
                                                                                                                                                                                                                              Function 00007FF611302710 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 194windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: MessageSend$Create$Window$BaseClientDialogFontIconIndirectInfoLoadMetricParametersRectSystemUnits
                                                                                                                                                                                                                              • String ID: $BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                              • API String ID: 3223904152-1365983254
                                                                                                                                                                                                                              • Opcode ID: 23d76df661166ccc8bf8808f21f1e890a82357284aeaf219810838731c85fa8c
                                                                                                                                                                                                                              • Instruction ID: 71ff43d844c84a8a613212993264d43aaf56f03bbba0739b1e19ffdf6de324d7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23d76df661166ccc8bf8808f21f1e890a82357284aeaf219810838731c85fa8c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 58917736218B9582E7508F61E45479A7764F788BD8F24413AEE8C4BB9CCF7EC185CB50
                                                                                                                                                                                                                              Function 655C38D6 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 418stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Deallocfreemallocmemcpystrcmp
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$N+
                                                                                                                                                                                                                              • API String ID: 2421945241-2748867177
                                                                                                                                                                                                                              • Opcode ID: ee4242ee41b193a42d94519b6a8b0116eb396db683662b50cbf8477bce9514d9
                                                                                                                                                                                                                              • Instruction ID: 52ab15b8704c81bc7e8fba4193c0447d62dd4095ab519d2d5a0cfcade352836e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee4242ee41b193a42d94519b6a8b0116eb396db683662b50cbf8477bce9514d9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E7F15632348B4486EB10CF65D89875D3771FB86B9AF88865ADEAA0B794DF3DC111C702
                                                                                                                                                                                                                              Function 655C2C80 Relevance: 42.3, APIs: 20, Strings: 4, Instructions: 282librarystringloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyEval_GetGlobals.PYTHON311 ref: 655C2CE4
                                                                                                                                                                                                                              • PyFunction_NewWithQualName.PYTHON311 ref: 655C2CF3
                                                                                                                                                                                                                              • _PyObject_CallFunction_SizeT.PYTHON311 ref: 655C2D2F
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C2D71
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C2E4A
                                                                                                                                                                                                                              • GetProcAddress.KERNEL32 ref: 655C2E6A
                                                                                                                                                                                                                              • strlen.MSVCRT ref: 655C2E82
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C3147
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyList_New.PYTHON311 ref: 655CE71B
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyErr_Occurred.PYTHON311 ref: 655CE73A
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyMem_Free.PYTHON311 ref: 655CE768
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C2F99
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C2FAD
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C2FD9
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3003
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3013
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dealloc$Err_$FormatFunction_$AddressCallEval_FreeGlobalsList_Mem_NameObject_OccurredProcQualSizeWithstrlen
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$/proc/se$lf/exe$z(
                                                                                                                                                                                                                              • API String ID: 3243918594-3850701646
                                                                                                                                                                                                                              • Opcode ID: 247711cc8750c9647cd6b3fe3b2e3546c073088cc010281dfbb464265b1a000f
                                                                                                                                                                                                                              • Instruction ID: f790aeaffac7158bc616b9d1a88099f53dddadac081fd26329426cfdd115c343
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 247711cc8750c9647cd6b3fe3b2e3546c073088cc010281dfbb464265b1a000f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 45B19D71304B8885EF10CFAAEC983593362F786F95F895569EDAA077A4DF2DC502C342
                                                                                                                                                                                                                              Function 655CF240 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 224COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _PyErr_SetString.PYTHON311 ref: 655CF2CD
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655CF2E5
                                                                                                                                                                                                                              • _PyErr_SetString.PYTHON311 ref: 655CF31E
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655CF331
                                                                                                                                                                                                                              • _Py_CheckFunctionResult.PYTHON311 ref: 655CF434
                                                                                                                                                                                                                              • _PyErr_GetTopmostException.PYTHON311 ref: 655CF465
                                                                                                                                                                                                                              • PyException_GetTraceback.PYTHON311 ref: 655CF490
                                                                                                                                                                                                                              • _PyErr_Restore.PYTHON311 ref: 655CF4A2
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • calling %R should have returned an instance of BaseException, not %R, xrefs: 655CF52C
                                                                                                                                                                                                                              • No active exception to reraise, xrefs: 655CF4F7
                                                                                                                                                                                                                              • exception causes must derive from BaseException, xrefs: 655CF2C0
                                                                                                                                                                                                                              • exceptions must derive from BaseException, xrefs: 655CF311
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$DeallocString$CheckExceptionException_FunctionRestoreResultTopmostTraceback
                                                                                                                                                                                                                              • String ID: No active exception to reraise$calling %R should have returned an instance of BaseException, not %R$exception causes must derive from BaseException$exceptions must derive from BaseException
                                                                                                                                                                                                                              • API String ID: 2601484037-3751834042
                                                                                                                                                                                                                              • Opcode ID: 8ba1f6017095ec3cedd976614c960a210503e3d01fcd907734c4866b344e0e40
                                                                                                                                                                                                                              • Instruction ID: f41d6a088aa836fc2c3bf083b839ce0e8a0444c786563c40d6b61090b04d48a3
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ba1f6017095ec3cedd976614c960a210503e3d01fcd907734c4866b344e0e40
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 03810476304A4592EB05CFA6ED5876AB3A1BB85FD9F88406ACF5A07B24DF3DC051C342
                                                                                                                                                                                                                              Function 655D1FE0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 156memoryfileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 655D202C
                                                                                                                                                                                                                              • CreateFileA.KERNEL32 ref: 655D2060
                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32 ref: 655D207A
                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32 ref: 655D20F4
                                                                                                                                                                                                                              • GlobalFree.KERNEL32 ref: 655D210A
                                                                                                                                                                                                                              • _snprintf.MSVCRT ref: 655D2147
                                                                                                                                                                                                                              • CreateFileA.KERNEL32 ref: 655D2174
                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32 ref: 655D2195
                                                                                                                                                                                                                              • GlobalAlloc.KERNEL32 ref: 655D21A4
                                                                                                                                                                                                                              • DeviceIoControl.KERNEL32 ref: 655D21EC
                                                                                                                                                                                                                              • GlobalFree.KERNEL32 ref: 655D2205
                                                                                                                                                                                                                              • GlobalFree.KERNEL32 ref: 655D220A
                                                                                                                                                                                                                              • CloseHandle.KERNEL32 ref: 655D2214
                                                                                                                                                                                                                              • GlobalFree.KERNEL32 ref: 655D2236
                                                                                                                                                                                                                                • Part of subcall function 655D1C90: GetLastError.KERNEL32 ref: 655D1C94
                                                                                                                                                                                                                                • Part of subcall function 655D1C90: FormatMessageA.KERNEL32 ref: 655D1CC5
                                                                                                                                                                                                                                • Part of subcall function 655D1C90: LocalFree.KERNEL32 ref: 655D1CE6
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Global$Free$Alloc$ControlCreateDeviceFile_snprintf$CloseErrorFormatHandleLastLocalMessage
                                                                                                                                                                                                                              • String ID: ../src/platforms/windows/hdinfo.c$/%d:$Empty serial number$SCSIDISK$\\.\PhysicalDrive%d$\\.\Scsi%d
                                                                                                                                                                                                                              • API String ID: 1119308327-3953537554
                                                                                                                                                                                                                              • Opcode ID: a4f73a8c55f752131cfff48b1cbc1c5c221bfaee8996120c7e8e752da0d811c9
                                                                                                                                                                                                                              • Instruction ID: feb47aa9529fd730e1430cb76b398285d99e96e23acfc6bb75024a7bacafbb22
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a4f73a8c55f752131cfff48b1cbc1c5c221bfaee8996120c7e8e752da0d811c9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1F51F132304A8486E7508F66FC1874A7B55F789BE9F444225EE5A0BBE4CF3EC546C744
                                                                                                                                                                                                                              Function 655D31A0 Relevance: 38.6, APIs: 19, Strings: 3, Instructions: 149networkCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorLast$Cleanup$closesocketntohlsetsockopt$Startupgethostbynamehtonsrecvfromsendtosocket
                                                                                                                                                                                                                              • String ID: and,$http://$or,
                                                                                                                                                                                                                              • API String ID: 1750001962-2642771825
                                                                                                                                                                                                                              • Opcode ID: ac908f9a647537c59e5159757bf4edb9f7350e11fa443e029558993d3dbf3d4c
                                                                                                                                                                                                                              • Instruction ID: a94b9126e5892ea2b24d641bf68394bf595295f54b44855c1fba93b71b02ad5f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac908f9a647537c59e5159757bf4edb9f7350e11fa443e029558993d3dbf3d4c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66519232304B8086E7108B29F85871AB7A1F789BB5F540329EEA947BE4DF7DC449CB41
                                                                                                                                                                                                                              Function 655D2390 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 171fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CloseHandleisxdigitmemset$ControlCreateDeviceFileisprintmemcpywsprintf
                                                                                                                                                                                                                              • String ID: /%d:$\\.\PhysicalDrive%d
                                                                                                                                                                                                                              • API String ID: 2355516209-72258043
                                                                                                                                                                                                                              • Opcode ID: 23ca530a71485b923bb56634c81bac0a6854ad57cf9354958a780a15327ad4ca
                                                                                                                                                                                                                              • Instruction ID: 168fc219271978ed4de27a2302d44774f6627270f346c04f0e123d56d10bc8cc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 23ca530a71485b923bb56634c81bac0a6854ad57cf9354958a780a15327ad4ca
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9551057330CB8085E711CB2AEC5875BFB92BB82798F444225EEA547B99DB7EC148C744
                                                                                                                                                                                                                              Function 655E4530 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 110encryptionCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Cryptclock$Context$Acquire$RandomRelease
                                                                                                                                                                                                                              • String ID: ($Microsoft Base Cryptographic Provider v1.0$out != NULL$src/prngs/rng_get_bytes.c
                                                                                                                                                                                                                              • API String ID: 2525729555-3762154145
                                                                                                                                                                                                                              • Opcode ID: d01d45094c82ff83c1900061e6dd3bc7f3301a895776b6cf7dda1b35aacd282a
                                                                                                                                                                                                                              • Instruction ID: e58e54692462242c1fdc6e7e2557521506856d5706106ad9859abb0a4baffbd9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d01d45094c82ff83c1900061e6dd3bc7f3301a895776b6cf7dda1b35aacd282a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0931D83230CA50C1EB10CF66FC4875A76A6B7897D8F409025DE8A83714DF7AC586C741
                                                                                                                                                                                                                              Function 00007FFD930B266C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 168COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: EnvironmentVariable$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: .rnd$HOME$RANDFILE$SYSTEMROOT$USERPROFILE
                                                                                                                                                                                                                              • API String ID: 2184640988-1666712896
                                                                                                                                                                                                                              • Opcode ID: 419c88fdedd40b7a4bd6282dbefca93637e627fdfe4ba8766129e23dca955196
                                                                                                                                                                                                                              • Instruction ID: 7cb6b4904630aea12a0f7e91f98e7d2f3e73f9e9409373c9c36e412829e21fd8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 419c88fdedd40b7a4bd6282dbefca93637e627fdfe4ba8766129e23dca955196
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1611A26718B8286EB21AFA2986017967E9FF95BA4B944235DE1E637D4DF3DE005C300
                                                                                                                                                                                                                              Function 00007FFD930B5A1F Relevance: 13.6, APIs: 9, Instructions: 73COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 313767242-0
                                                                                                                                                                                                                              • Opcode ID: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
                                                                                                                                                                                                                              • Instruction ID: 25910172d6ffe95653d617f1a8265d6024bc81a4a3a3b30aace14d41f491e4ef
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 836932d6aed314119f7ddbe256598baef3b0bd20caf5fb751809a6c17d89e7ea
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ED313D76708A82C6EB709FA1E8603EA7369FB84744F944039DA4E97A98DF3CD548C714
                                                                                                                                                                                                                              Function 6563F900 Relevance: 12.0, APIs: 8, Instructions: 50COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • RtlCaptureContext.KERNEL32 ref: 6563F914
                                                                                                                                                                                                                              • RtlLookupFunctionEntry.KERNEL32 ref: 6563F92B
                                                                                                                                                                                                                              • RtlVirtualUnwind.KERNEL32 ref: 6563F96D
                                                                                                                                                                                                                              • SetUnhandledExceptionFilter.KERNEL32 ref: 6563F9B1
                                                                                                                                                                                                                              • UnhandledExceptionFilter.KERNEL32 ref: 6563F9BE
                                                                                                                                                                                                                              • GetCurrentProcess.KERNEL32 ref: 6563F9C4
                                                                                                                                                                                                                              • TerminateProcess.KERNEL32 ref: 6563F9D2
                                                                                                                                                                                                                              • abort.MSVCRT ref: 6563F9D8
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4278921479-0
                                                                                                                                                                                                                              • Opcode ID: 6ad85b7cfbc7a52b106bcb33ee71a27bd56fb71e564510aab3933e9ec0d0410d
                                                                                                                                                                                                                              • Instruction ID: 564f19d972da86d82649811458780db4fc5f1688f9817febc19d481c79d9adfe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6ad85b7cfbc7a52b106bcb33ee71a27bd56fb71e564510aab3933e9ec0d0410d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0210472350F44A9EB008F55FC8438A33A6BB08B96F845126EA4E57728EF3AC265C340
                                                                                                                                                                                                                              Function 655C3AC1 Relevance: 7.7, APIs: 5, Instructions: 240COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: f645a68db3762830e810a3451719be7f6e62bfce9e17296ed75c52f8707522dd
                                                                                                                                                                                                                              • Instruction ID: 27f91e278fb67372d37045930ec81c24e4f6cc9669eec799b6884df0495217c9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f645a68db3762830e810a3451719be7f6e62bfce9e17296ed75c52f8707522dd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 23A1F4B3308ADDA7C742CF69D00429FBBB0F705B0DB9AC449EB5A4A111D736D95AC742
                                                                                                                                                                                                                              Function 6563F820 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32 ref: 6563F865
                                                                                                                                                                                                                              • GetCurrentProcessId.KERNEL32 ref: 6563F870
                                                                                                                                                                                                                              • GetCurrentThreadId.KERNEL32 ref: 6563F879
                                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 6563F881
                                                                                                                                                                                                                              • QueryPerformanceCounter.KERNEL32 ref: 6563F88E
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1445889803-0
                                                                                                                                                                                                                              • Opcode ID: caebf993aaf1fac0d96827145f2accaa4e8670c55ef45c91e764b5a04bd635f3
                                                                                                                                                                                                                              • Instruction ID: a95bf537698700109e6d97e5686221bb048d36cbf4159aeb0686cc11a2a1447b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: caebf993aaf1fac0d96827145f2accaa4e8670c55ef45c91e764b5a04bd635f3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A5115E26755F9041FB508B25FC04355A2A1B748BB2F885735AE9D47BA8EF3DC495C700
                                                                                                                                                                                                                              Function 00007FFD930B4241 Relevance: .0, Instructions: 33COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 6d58eeaf8cd2fa5640d15759ddfc5afba554c71bdb7935a9bc8fe32cedcf6388
                                                                                                                                                                                                                              • Instruction ID: dc01ecdc313615c6dd4e59cc2e015487f976ca272509e1461634f708a8953248
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d58eeaf8cd2fa5640d15759ddfc5afba554c71bdb7935a9bc8fe32cedcf6388
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40F0E9323283E105CB65CA77B50CF592DD69391BC8F16C030D90CD3F58E92EC6018B40
                                                                                                                                                                                                                              Function 00007FFD930B572C Relevance: .0, Instructions: 22COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 8b647e036b0e5ae8a118200442eb522906dc17efbe743a2891263b2f3e414abb
                                                                                                                                                                                                                              • Instruction ID: 191262fc9528dab0aa81f25078ea3a72852f50af94685377317ea0315868d1bd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8b647e036b0e5ae8a118200442eb522906dc17efbe743a2891263b2f3e414abb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B4E0DF737183A405C766CE737218E692A99A714B89F43C030DA0DE3F59EC2EC601CB40
                                                                                                                                                                                                                              Function 00007FF6113059C0 Relevance: 233.2, APIs: 44, Strings: 89, Instructions: 451libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                              • API String ID: 190572456-4266016200
                                                                                                                                                                                                                              • Opcode ID: 50e6ba4ab6fb6236e3085a79b8dda0dff8723994d665336298622606d247f3f2
                                                                                                                                                                                                                              • Instruction ID: 7968e8721a7397b5826d877ad782a8669c129fe8c64f7ffa4e4c6d67a4746fe7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 50e6ba4ab6fb6236e3085a79b8dda0dff8723994d665336298622606d247f3f2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7132B260A5DF0790EF19DB14A8511B823BDBF44BA0B94903AC44EC26ADEF7CF609D351
                                                                                                                                                                                                                              Function 00007FF611307680 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 324libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                                              • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                              • API String ID: 190572456-2208601799
                                                                                                                                                                                                                              • Opcode ID: bd663cd79cc008e1fc6f487746503f053cd2f66c41a095d1ba5e11cdaee36601
                                                                                                                                                                                                                              • Instruction ID: 4ae7d2a216f3e0059a1e070bf8d7edda1573c9c8b6ae2da92e8bd57570d55d0d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd663cd79cc008e1fc6f487746503f053cd2f66c41a095d1ba5e11cdaee36601
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 85F17360A0DF0790FF16EB28A8550B423ADAF55FB0B945436D44EC62ADEF7CE64AC350
                                                                                                                                                                                                                              Function 655D2A10 Relevance: 75.7, APIs: 27, Strings: 16, Instructions: 436filestringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D2A4E
                                                                                                                                                                                                                                • Part of subcall function 655D2660: strlen.MSVCRT ref: 655D2683
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2A87
                                                                                                                                                                                                                                • Part of subcall function 655D2880: strlen.MSVCRT ref: 655D289A
                                                                                                                                                                                                                              • fputc.MSVCRT ref: 655D2AB9
                                                                                                                                                                                                                                • Part of subcall function 655D1D00: GetProcessHeap.KERNEL32 ref: 655D1D23
                                                                                                                                                                                                                                • Part of subcall function 655D1D00: HeapAlloc.KERNEL32 ref: 655D1D37
                                                                                                                                                                                                                                • Part of subcall function 655D1D00: GetAdaptersAddresses.IPHLPAPI ref: 655D1D5C
                                                                                                                                                                                                                                • Part of subcall function 655D1D00: GetProcessHeap.KERNEL32 ref: 655D1DCF
                                                                                                                                                                                                                                • Part of subcall function 655D1D00: HeapFree.KERNEL32 ref: 655D1DD9
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2AE8
                                                                                                                                                                                                                                • Part of subcall function 655D1B10: GetProcessHeap.KERNEL32 ref: 655D1B31
                                                                                                                                                                                                                                • Part of subcall function 655D1B10: HeapAlloc.KERNEL32 ref: 655D1B46
                                                                                                                                                                                                                                • Part of subcall function 655D1B10: memcpy.MSVCRT ref: 655D1BBC
                                                                                                                                                                                                                                • Part of subcall function 655D1B10: GetProcessHeap.KERNEL32 ref: 655D1BDA
                                                                                                                                                                                                                                • Part of subcall function 655D1B10: HeapFree.KERNEL32 ref: 655D1BE5
                                                                                                                                                                                                                              • fputc.MSVCRT ref: 655D2B1B
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: GetProcessHeap.KERNEL32 ref: 655D1EB3
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: HeapAlloc.KERNEL32 ref: 655D1EC7
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: GetAdaptersAddresses.IPHLPAPI ref: 655D1EEF
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: inet_ntoa.WS2_32 ref: 655D1F27
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: GetProcessHeap.KERNEL32 ref: 655D1F42
                                                                                                                                                                                                                                • Part of subcall function 655D1E90: HeapFree.KERNEL32 ref: 655D1F4C
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2B4A
                                                                                                                                                                                                                              • fputc.MSVCRT ref: 655D2B5E
                                                                                                                                                                                                                                • Part of subcall function 655D2290: GetProcessHeap.KERNEL32 ref: 655D22AB
                                                                                                                                                                                                                                • Part of subcall function 655D2290: HeapAlloc.KERNEL32 ref: 655D22BF
                                                                                                                                                                                                                                • Part of subcall function 655D2290: GetNetworkParams.IPHLPAPI ref: 655D22F7
                                                                                                                                                                                                                                • Part of subcall function 655D2290: GetProcessHeap.KERNEL32 ref: 655D2319
                                                                                                                                                                                                                                • Part of subcall function 655D2290: HeapFree.KERNEL32 ref: 655D2323
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2B8D
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D2BAE
                                                                                                                                                                                                                              • strchr.MSVCRT ref: 655D2BDB
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D2C13
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2C3B
                                                                                                                                                                                                                              • strchr.MSVCRT ref: 655D2C48
                                                                                                                                                                                                                              • fprintf.MSVCRT ref: 655D2C69
                                                                                                                                                                                                                              • fputc.MSVCRT ref: 655D2C82
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D2CA3
                                                                                                                                                                                                                              • malloc.MSVCRT ref: 655D2CAD
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D3047
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D3068
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D3089
                                                                                                                                                                                                                              • fwrite.MSVCRT ref: 655D30AA
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Domain name: "%s", xrefs: 655D2B80
                                                                                                                                                                                                                              • Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux, xrefs: 655D2B99
                                                                                                                                                                                                                              • %02x, xrefs: 655D2FBD
                                                                                                                                                                                                                              • Failed to get harddisk information., xrefs: 655D3032
                                                                                                                                                                                                                              • %02x:, xrefs: 655D2F5E
                                                                                                                                                                                                                              • Serial number of default harddisk: "%s", xrefs: 655D2A7A
                                                                                                                                                                                                                              • Ip address: "%s", xrefs: 655D2B3D
                                                                                                                                                                                                                              • Failed to get ip address., xrefs: 655D3074
                                                                                                                                                                                                                              • Multiple Mac addresses: "<, xrefs: 655D2C8E
                                                                                                                                                                                                                              • Serial number with disk name: , xrefs: 655D2BFE
                                                                                                                                                                                                                              • "%s", xrefs: 655D2C1D, 655D2C5C
                                                                                                                                                                                                                              • Failed to get domain name., xrefs: 655D3095
                                                                                                                                                                                                                              • Hardware informations got by PyArmor:, xrefs: 655D2A36
                                                                                                                                                                                                                              • >", xrefs: 655D3007
                                                                                                                                                                                                                              • Default Mac address: "%s", xrefs: 655D2ADB
                                                                                                                                                                                                                              • Failed to get mac address., xrefs: 655D3053
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Processfwrite$fprintf$AllocFreefputc$AdaptersAddressesstrchrstrlen$NetworkParamsinet_ntoamallocmemcpy
                                                                                                                                                                                                                              • String ID: "%s"$Change logsv6.2.0(r21): Remove trailing dot from harddisk serial numberv6.4.2(r34): Support binding multiple mac addressesv6.5.3(r37): Support binding named harddiskv6.7.5(r45): Support mmc/sd card in Linux$%02x$%02x:$>"$Default Mac address: "%s"$Domain name: "%s"$Failed to get domain name.$Failed to get harddisk information.$Failed to get ip address.$Failed to get mac address.$Hardware informations got by PyArmor:$Ip address: "%s"$Multiple Mac addresses: "<$Serial number of default harddisk: "%s"$Serial number with disk name:
                                                                                                                                                                                                                              • API String ID: 3427000353-3771683696
                                                                                                                                                                                                                              • Opcode ID: 6dc0d441b75f141d5a923415609b4b8fcf4df4210b4c1e63c15a3248b4216819
                                                                                                                                                                                                                              • Instruction ID: a51f26d9095897187b7b15f1ff5ae1ac68a716047c524c395baeceda126df1c3
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6dc0d441b75f141d5a923415609b4b8fcf4df4210b4c1e63c15a3248b4216819
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7502AE33309B9086DB90CB69E85835EB7A2F789794F408629DF9D4B798DF39C144C709
                                                                                                                                                                                                                              Function 655C33ED Relevance: 57.9, APIs: 25, Strings: 8, Instructions: 171COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyImport_GetModuleDict.PYTHON311 ref: 655C33ED
                                                                                                                                                                                                                              • PyDict_GetItemString.PYTHON311 ref: 655C3400
                                                                                                                                                                                                                              • PyModule_GetDict.PYTHON311 ref: 655C340E
                                                                                                                                                                                                                              • PyDict_GetItemString.PYTHON311 ref: 655C3427
                                                                                                                                                                                                                              • PyObject_GetAttrString.PYTHON311 ref: 655C344D
                                                                                                                                                                                                                              • PyList_GetItem.PYTHON311 ref: 655C3461
                                                                                                                                                                                                                              • _PyObject_CallFunction_SizeT.PYTHON311 ref: 655C34A6
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C34D7
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C34E9
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C34F5
                                                                                                                                                                                                                              • PyErr_Clear.PYTHON311 ref: 655C3580
                                                                                                                                                                                                                              • getenv.MSVCRT ref: 655C358D
                                                                                                                                                                                                                              • PyUnicode_FromFormat.PYTHON311(?,?,?,?,?,?), ref: 655C35AA
                                                                                                                                                                                                                              • _PyObject_CallFunction_SizeT.PYTHON311(?,?,?,?,?,?), ref: 655C35D7
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C3605
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C3617
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3623
                                                                                                                                                                                                                              • PyList_GetItem.PYTHON311 ref: 655C3685
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3824
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Object_$CallSize$ItemMethod_$DeallocString$DictDict_Function_List_$AttrClearErr_FormatFromImport_ModuleModule_Unicode_getenv
                                                                                                                                                                                                                              • String ID: %U/%s$%U/../%s$%s/%s$PYARMOR_RKEY$__path__$_path$close$read
                                                                                                                                                                                                                              • API String ID: 2543034039-1237617226
                                                                                                                                                                                                                              • Opcode ID: 6645aa77723c6f09655ebe9b7e33ff54acc4774b7ff7190aee5297d77cef4eb5
                                                                                                                                                                                                                              • Instruction ID: 697e6c19b04f0f6984914a7061c8b994779c54f6ea107b0a85748601154476cd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6645aa77723c6f09655ebe9b7e33ff54acc4774b7ff7190aee5297d77cef4eb5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 28619F61306E1499EE45DF6AEC1879523E2BB49FC6FC98479AC0E07320EF3AD059C352
                                                                                                                                                                                                                              Function 655C8260 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 205COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyTuple_Size.PYTHON311 ref: 655C8281
                                                                                                                                                                                                                              • PyTuple_New.PYTHON311 ref: 655C828D
                                                                                                                                                                                                                              • _PyObject_LookupAttr.PYTHON311 ref: 655C830C
                                                                                                                                                                                                                              • PyObject_GetAttr.PYTHON311 ref: 655C831E
                                                                                                                                                                                                                              • PyModule_GetFilenameObject.PYTHON311 ref: 655C834A
                                                                                                                                                                                                                              • PyUnicode_FromString.PYTHON311 ref: 655C835A
                                                                                                                                                                                                                              • _PyErr_Clear.PYTHON311(?,?,00000000,?,00000000,?,?,?,?,?,655CFAFF), ref: 655C8394
                                                                                                                                                                                                                              • PyErr_SetImportError.PYTHON311 ref: 655C83B9
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C83D8
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S), xrefs: 655C850C
                                                                                                                                                                                                                              • cannot import name %R from %R (unknown location), xrefs: 655C839F
                                                                                                                                                                                                                              • %U.%U, xrefs: 655C8432
                                                                                                                                                                                                                              • <unknown module name>, xrefs: 655C8353
                                                                                                                                                                                                                              • cannot import name %R from %R (%S), xrefs: 655C84EA
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AttrErr_Object_Tuple_$ClearDeallocErrorFilenameFromImportLookupModule_ObjectSizeStringUnicode_
                                                                                                                                                                                                                              • String ID: %U.%U$<unknown module name>$cannot import name %R from %R (%S)$cannot import name %R from %R (unknown location)$cannot import name %R from partially initialized module %R (most likely due to a circular import) (%S)
                                                                                                                                                                                                                              • API String ID: 597108667-3215622635
                                                                                                                                                                                                                              • Opcode ID: 14f415cb069d77af9b1b46768b3645fdddab11c724015a8728e0a1272c8fe63b
                                                                                                                                                                                                                              • Instruction ID: a92e745313617122463ee03642e6a733b014b74a08ebd202791e59ca37e63a32
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14f415cb069d77af9b1b46768b3645fdddab11c724015a8728e0a1272c8fe63b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18818A32309E4485DA049F96EC5875A77A2B786FDAF885069EE4E07724EF39C155C303
                                                                                                                                                                                                                              Function 655C9A70 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 252COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • bad marshal data (digit out of range in long), xrefs: 655C9C2A
                                                                                                                                                                                                                              • bad marshal data (long size out of range), xrefs: 655CAF15
                                                                                                                                                                                                                              • bad marshal data (unnormalized long data), xrefs: 655CAFF9
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$Occurred$Long_String
                                                                                                                                                                                                                              • String ID: bad marshal data (digit out of range in long)$bad marshal data (long size out of range)$bad marshal data (unnormalized long data)
                                                                                                                                                                                                                              • API String ID: 3688822742-2912230410
                                                                                                                                                                                                                              • Opcode ID: 00873884a0396efe5a4cb7dae3380c39f0550bb95abd8fa2e13ab84476b2f55f
                                                                                                                                                                                                                              • Instruction ID: 5e7367967e9a0aa027078ff513ff533cf77fa0496e20c34997cb83d65618f63e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 00873884a0396efe5a4cb7dae3380c39f0550bb95abd8fa2e13ab84476b2f55f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 60A1983630AB9087DB00CF55D89871A77B2FB84BC8F158959EE4A47714EB39E851C782
                                                                                                                                                                                                                              Function 655D11B0 Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 254COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • missing kwonly required arguments, xrefs: 655D157A
                                                                                                                                                                                                                              • too many positional arguments, xrefs: 655D15E4
                                                                                                                                                                                                                              • Can't remove argname from kwargs, xrefs: 655D13D6
                                                                                                                                                                                                                              • missing required positional arguments, xrefs: 655D12F1
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dict_Err_ItemString$DeallocTuple_
                                                                                                                                                                                                                              • String ID: Can't remove argname from kwargs$missing kwonly required arguments$missing required positional arguments$too many positional arguments
                                                                                                                                                                                                                              • API String ID: 2174600326-1903473336
                                                                                                                                                                                                                              • Opcode ID: 6f517f8eb85a8be06516c221eefb980b294ec5352012619a9e5be5e97d842ffb
                                                                                                                                                                                                                              • Instruction ID: dc9457715c45782eb36ffebd4df1c14b797b06736fc1b8d65a1fefd77d28cd34
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6f517f8eb85a8be06516c221eefb980b294ec5352012619a9e5be5e97d842ffb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 70B18B73609F8081DB25CF1AE84875AB3A6F785BE9F448211DE6E47B68CF3AC095C305
                                                                                                                                                                                                                              Function 655CF5D0 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 236COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • not enough values to unpack (expected %d, got %d), xrefs: 655CF921
                                                                                                                                                                                                                              • too many values to unpack (expected %d), xrefs: 655CF880
                                                                                                                                                                                                                              • not enough values to unpack (expected at least %d, got %zd), xrefs: 655CF8D3
                                                                                                                                                                                                                              • cannot unpack non-iterable %.200s object, xrefs: 655CF846
                                                                                                                                                                                                                              • not enough values to unpack (expected at least %d, got %d), xrefs: 655CF8B8
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Sequence_$CheckDeallocErr_FormatIterIter_ListNextObject_
                                                                                                                                                                                                                              • String ID: cannot unpack non-iterable %.200s object$not enough values to unpack (expected %d, got %d)$not enough values to unpack (expected at least %d, got %d)$not enough values to unpack (expected at least %d, got %zd)$too many values to unpack (expected %d)
                                                                                                                                                                                                                              • API String ID: 3840349905-1344257351
                                                                                                                                                                                                                              • Opcode ID: 0c8801bf2ea2789352598e9cc15a09dabf71c224803ac48eb0cc23b97187fb66
                                                                                                                                                                                                                              • Instruction ID: 1965729d9535853e115b8447a572c3250fabf3e4e072b69e02d35623f55f6cf5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0c8801bf2ea2789352598e9cc15a09dabf71c224803ac48eb0cc23b97187fb66
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1081FE72705E4586DF04CFA9E8087A973A2FB44FC9F85866ACE6A17324DF39C594C342
                                                                                                                                                                                                                              Function 00007FF611301D40 Relevance: 33.4, APIs: 6, Strings: 13, Instructions: 139COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fclose$_wfopenfreadfreemalloc
                                                                                                                                                                                                                              • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                                              • API String ID: 414440483-3833288071
                                                                                                                                                                                                                              • Opcode ID: 59301d2b38f1c2ff1f5a3ec36f6c4db0f3c8ec6cb92ecfabbd317690c13ec07b
                                                                                                                                                                                                                              • Instruction ID: 4b9eb521ea7793155c10e2113c74a54d2ecae7714d3d2acfba578de245b604be
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59301d2b38f1c2ff1f5a3ec36f6c4db0f3c8ec6cb92ecfabbd317690c13ec07b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 69518021E0DD5741FB15972598506FA12A9AF14FF8F88023AED0DCB2DEEE6CE949C340
                                                                                                                                                                                                                              Function 655CDEB0 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 480fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwrite$Err_String
                                                                                                                                                                                                                              • String ID: too many objects
                                                                                                                                                                                                                              • API String ID: 4210527972-4209268247
                                                                                                                                                                                                                              • Opcode ID: f17f68b2bce66fe46961a9f06636144348ff5c4c0489542c21228fd78f81dc02
                                                                                                                                                                                                                              • Instruction ID: c6891efe90be7ef30e2be68026dd1bcdfb90c83e62b8764b3efcd08c9b5b7544
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f17f68b2bce66fe46961a9f06636144348ff5c4c0489542c21228fd78f81dc02
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FA12BDB2204B8482DB11CFA9D44978973B1F719FE8F50425ADE2D5B788DB39D5A2C3C2
                                                                                                                                                                                                                              Function 655C9D13 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 172COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C9D24
                                                                                                                                                                                                                              • _Py_CheckFunctionResult.PYTHON311 ref: 655CA6F6
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • bad marshal data (set size out of range), xrefs: 655CACAE
                                                                                                                                                                                                                              • NULL object in marshal data for set, xrefs: 655CB121
                                                                                                                                                                                                                              • bad marshal data (index list too large), xrefs: 655CB2C3
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CheckErr_FunctionOccurredResult
                                                                                                                                                                                                                              • String ID: NULL object in marshal data for set$bad marshal data (index list too large)$bad marshal data (set size out of range)
                                                                                                                                                                                                                              • API String ID: 3781139737-600355161
                                                                                                                                                                                                                              • Opcode ID: 083acb2e0987009778e16f363f5f9939724758c1e64ffa0f5970b46e1c5f64e2
                                                                                                                                                                                                                              • Instruction ID: fd1f302a08f971f9113e9429ed308cfe13ce8dbfd361dfb4a64580a1be51c299
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 083acb2e0987009778e16f363f5f9939724758c1e64ffa0f5970b46e1c5f64e2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4E717E31309F8081DB60CF96E89871A37B2F786BA5F419559DD6E07B64DF39C484C382
                                                                                                                                                                                                                              Function 655C8810 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyFloat_Unpack8.PYTHON311 ref: 655C8841
                                                                                                                                                                                                                              • PyBuffer_FillInfo.PYTHON311 ref: 655C8896
                                                                                                                                                                                                                              • PyMemoryView_FromBuffer.PYTHON311 ref: 655C88A4
                                                                                                                                                                                                                              • _PyObject_CallMethod.PYTHON311 ref: 655C88CB
                                                                                                                                                                                                                              • PyNumber_AsSsize_t.PYTHON311 ref: 655C88EA
                                                                                                                                                                                                                              • PyErr_SetString.PYTHON311 ref: 655C8A21
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • EOF read where not expected, xrefs: 655C8982
                                                                                                                                                                                                                              • marshal data too short, xrefs: 655C8A17
                                                                                                                                                                                                                              • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 655C89F5
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: BufferBuffer_CallErr_FillFloat_FromInfoMemoryMethodNumber_Object_Ssize_tStringUnpack8View_
                                                                                                                                                                                                                              • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                                              • API String ID: 2634123556-4172231876
                                                                                                                                                                                                                              • Opcode ID: db42527f7ae0679790ee4cec7e3a278c086182decf5ad1a647ddf837da48021d
                                                                                                                                                                                                                              • Instruction ID: f96c0173ae610800642a3a7134558390bd6a0d22c06bcc997b7a54749f37e3dc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: db42527f7ae0679790ee4cec7e3a278c086182decf5ad1a647ddf837da48021d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB518E21305E0485EB44CFA9EC587192362FB45FEAF804629D96E47BA4DF39C596C343
                                                                                                                                                                                                                              Function 655C8A50 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 121COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyBuffer_FillInfo.PYTHON311 ref: 655C8AD6
                                                                                                                                                                                                                              • PyMemoryView_FromBuffer.PYTHON311 ref: 655C8AE4
                                                                                                                                                                                                                              • _PyObject_CallMethod.PYTHON311 ref: 655C8B0B
                                                                                                                                                                                                                              • PyNumber_AsSsize_t.PYTHON311 ref: 655C8B2A
                                                                                                                                                                                                                              • PyErr_SetString.PYTHON311 ref: 655C8C51
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • EOF read where not expected, xrefs: 655C8BB2
                                                                                                                                                                                                                              • marshal data too short, xrefs: 655C8C47
                                                                                                                                                                                                                              • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 655C8C25
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: BufferBuffer_CallErr_FillFromInfoMemoryMethodNumber_Object_Ssize_tStringView_
                                                                                                                                                                                                                              • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                                              • API String ID: 3081723458-4172231876
                                                                                                                                                                                                                              • Opcode ID: 3b14d9ae4856d76fa188d4f64d7074492a9e3ea4905703606545de34714b4faf
                                                                                                                                                                                                                              • Instruction ID: c68b7472b8a7aa176c8d327b35ab7b3483fc079cc2df7d248594090e97eb0805
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3b14d9ae4856d76fa188d4f64d7074492a9e3ea4905703606545de34714b4faf
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0A4117B1305E0482EB44CBA9EC487182362B749FBAF944769DA2D477E4DF39C49AC343
                                                                                                                                                                                                                              Function 655C8DB0 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyBuffer_FillInfo.PYTHON311 ref: 655C8E32
                                                                                                                                                                                                                              • PyMemoryView_FromBuffer.PYTHON311 ref: 655C8E40
                                                                                                                                                                                                                              • _PyObject_CallMethod.PYTHON311 ref: 655C8E6E
                                                                                                                                                                                                                              • PyNumber_AsSsize_t.PYTHON311 ref: 655C8E89
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C8EA2
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C8ED1
                                                                                                                                                                                                                              • PyErr_SetString.PYTHON311 ref: 655C8F83
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • EOF read where not expected, xrefs: 655C8F57
                                                                                                                                                                                                                              • marshal data too short, xrefs: 655C8F77
                                                                                                                                                                                                                              • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 655C8EC7
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$BufferBuffer_CallFillFormatFromInfoMemoryMethodNumber_Object_OccurredSsize_tStringView_
                                                                                                                                                                                                                              • String ID: EOF read where not expected$marshal data too short$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                                              • API String ID: 315596505-4172231876
                                                                                                                                                                                                                              • Opcode ID: 842c6c9091f9576b1bedeaedd11cbda09d8be00bb8eeb649c7e34976154dc40d
                                                                                                                                                                                                                              • Instruction ID: dccf4f5474baaf280ab131b0962473901efa5bef16e52ae259e93ca8294b720b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 842c6c9091f9576b1bedeaedd11cbda09d8be00bb8eeb649c7e34976154dc40d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E415D62305E0086EB14CF96EC487596362B789BE6F884769AE2E477A0DF39C495C343
                                                                                                                                                                                                                              Function 655C329E Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 94COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _PyObject_CallFunction_SizeT.PYTHON311 ref: 655C32E8
                                                                                                                                                                                                                              • PyErr_Clear.PYTHON311 ref: 655C3304
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C3364
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311(?,?,?,?,?,?), ref: 655C33A3
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311(?,?,?,?,?,?), ref: 655C33B5
                                                                                                                                                                                                                              • PySys_GetObject.PYTHON311 ref: 655C3517
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3573
                                                                                                                                                                                                                              • getenv.MSVCRT ref: 655C3647
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CallObject_Size$Err_Method_$ClearDeallocFormatFunction_ObjectSys_getenv
                                                                                                                                                                                                                              • String ID: %U.%s$%U/%s$%s (%d:%d)$%s/%s$PYARMOR_RKEY$close$executable$read
                                                                                                                                                                                                                              • API String ID: 2643494441-891831584
                                                                                                                                                                                                                              • Opcode ID: f0f956268247beaabe68f20a8f30ce52ae6e078e8a8891cae0e38a189c7d75e1
                                                                                                                                                                                                                              • Instruction ID: 3dcc05f7f76916350042ce9c8ad08d6812a88138331b6851469e8c90dc7f1f79
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f0f956268247beaabe68f20a8f30ce52ae6e078e8a8891cae0e38a189c7d75e1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EE31C131305E5891EB41CB9AEC943992392BB85FC2FC5847ADD0E07764EF2EC156C382
                                                                                                                                                                                                                              Function 655D03C0 Relevance: 27.2, APIs: 18, Instructions: 153COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dealloc$CallCheckErr_Object_Signals
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 356930793-0
                                                                                                                                                                                                                              • Opcode ID: fc0823230c3e19722e20bd8327469f16b7415beda282e57610dc4591245f7e78
                                                                                                                                                                                                                              • Instruction ID: e325df248cf01070d296216dc78f817de7b1301a077c8c1d683cf5a0efc86036
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc0823230c3e19722e20bd8327469f16b7415beda282e57610dc4591245f7e78
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 65516133349A04D6DA09DF2AED0CB7DB261BB45F99F484626DE1607A20FF39C095C345
                                                                                                                                                                                                                              Function 655D1D00 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 108memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • ../src/platforms/windows/hdinfo.c, xrefs: 655D1E57
                                                                                                                                                                                                                              • Too small size, xrefs: 655D1E50
                                                                                                                                                                                                                              • %02x:%02x:%02x:%02x:%02x:%02x, xrefs: 655D1D99
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Process$AdaptersAddressesAllocFree
                                                                                                                                                                                                                              • String ID: %02x:%02x:%02x:%02x:%02x:%02x$../src/platforms/windows/hdinfo.c$Too small size
                                                                                                                                                                                                                              • API String ID: 1283795797-3992030336
                                                                                                                                                                                                                              • Opcode ID: f60650675d38592f8edea1884d4fc273f2fdb2e9bfff8e7f9205ef8c4b45c98a
                                                                                                                                                                                                                              • Instruction ID: d5d1d314648b3643743c835b9236b0db553355fe67fb7807f2019e476d87b169
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f60650675d38592f8edea1884d4fc273f2fdb2e9bfff8e7f9205ef8c4b45c98a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9631C963304A908AD720DBBEAC1476EAB92E789BD4F444236BD5983794DF3CC541C744
                                                                                                                                                                                                                              Function 00007FF611309210 Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen_snwprintfcallocfree
                                                                                                                                                                                                                              • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                              • API String ID: 1339360106-2855260032
                                                                                                                                                                                                                              • Opcode ID: 840785790ae47b5b900202a130df978d56d1b00df71af0a86b378aa74ba62265
                                                                                                                                                                                                                              • Instruction ID: 370e3472d99b040be8d805f18e9f9b5db98e5ff1070d36b127e2876611467d72
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 840785790ae47b5b900202a130df978d56d1b00df71af0a86b378aa74ba62265
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5318121708A4682E710AB61F8047AA63A9FB85FB4F140235EE6DC7AD8EF7CE445C740
                                                                                                                                                                                                                              Function 655C1DF0 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 90stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strncmp$Err_Format_errno$freememcpystrlen
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$*DOMAIN:$*HARDDISK:$*IFIPV4:$*IFIPV6:$*IFMAC:$*MID:$5(
                                                                                                                                                                                                                              • API String ID: 3958490578-1731549688
                                                                                                                                                                                                                              • Opcode ID: bb3b97dd008b8ccd6e0d8b48d20d37051c0cf2b516f504ec13c3e7f792156655
                                                                                                                                                                                                                              • Instruction ID: 9775fd4fdb6363f6bb6c3498f46d82044ba8d2ad86810e86f2bffb4805e6acec
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb3b97dd008b8ccd6e0d8b48d20d37051c0cf2b516f504ec13c3e7f792156655
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 01210261310A1454FB90CB62EC887571A91BB4ABDAFC09069DC5E4F7D0DF3EC256C311
                                                                                                                                                                                                                              Function 00007FF61130F060 Relevance: 25.7, APIs: 17, Instructions: 211COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcstombs$setlocale$freembstowcsrealloc$_strdup
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1093732947-0
                                                                                                                                                                                                                              • Opcode ID: 4057a5c6bd61162031fd582af2eb34abd572d533eb0d544b39b7c2850e9da645
                                                                                                                                                                                                                              • Instruction ID: 358843187ec5ca5b56c6696eb846954c362f31337e0b70162652fa30255411a7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4057a5c6bd61162031fd582af2eb34abd572d533eb0d544b39b7c2850e9da645
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 43A12666B05F1989EB509BA6D8402BC33F8BB49FA8F404539DE5CA7B99EF3CD4018351
                                                                                                                                                                                                                              Function 00007FF611303340 Relevance: 25.7, APIs: 2, Strings: 15, Instructions: 196stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF6113032D0: strcpy.MSVCRT(00000000,?,_MEIPASS2,00000000,00007FF611303721), ref: 00007FF611303313
                                                                                                                                                                                                                              • strcmp.MSVCRT ref: 00007FF61130348A
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmpstrcpystrlen
                                                                                                                                                                                                                              • String ID: %s%c%s$%s%c%s%c%s$%s%c%s%c%s%c%s$%s%c%s.exe$%s%c%s.pkg$Archive path exceeds PATH_MAX$Failed to copy file %s from %s!$Failed to extract %s from referenced dependency archive %s.$Failed to open archive %s!$Failed to open referenced dependency archive %s.$Referenced dependency archive %s not found.$\$\$_MEIPASS2$pyi-contents-directory
                                                                                                                                                                                                                              • API String ID: 895318938-459211576
                                                                                                                                                                                                                              • Opcode ID: 263e37906a043b2d9e3251dbff4d8a345899adbdbf777523cd6fbb6d2135a085
                                                                                                                                                                                                                              • Instruction ID: 73cb16085dd900b7f67e777171b74fab2e3f0943e2e617497ff1a57581833976
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 263e37906a043b2d9e3251dbff4d8a345899adbdbf777523cd6fbb6d2135a085
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C814A25A0CE4689EB249B21E8446BB63ADAF44FF4F444132EA4DD77DEDE2CE506C740
                                                                                                                                                                                                                              Function 00007FFD930B4E3F Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 205registryfileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Event$FileSource$ByteCharDeregisterHandleMultiRegisterReportTypeWideWrite__stdio_common_vsprintf__stdio_common_vswprintf
                                                                                                                                                                                                                              • String ID: $OpenSSL$OpenSSL: FATAL$no stack?
                                                                                                                                                                                                                              • API String ID: 2603057392-2963566556
                                                                                                                                                                                                                              • Opcode ID: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
                                                                                                                                                                                                                              • Instruction ID: 834acf4c39b8b048bd2835df1cc5d1210b293a64329c37d74100576845ce8842
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4334f370b7a482bd35c4ecd3ae7f0d910e81077902a64c89114c2b2096981407
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C991E533B18B82C6EB349FA5D8601A83378FB45B94F844235EA5D67A99EF3CD255C300
                                                                                                                                                                                                                              Function 655CFF30 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Invalid type for op_build, xrefs: 655D018C
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: List_$DeallocDict_$ExtendTuple_Update
                                                                                                                                                                                                                              • String ID: Invalid type for op_build
                                                                                                                                                                                                                              • API String ID: 3794787204-1006902009
                                                                                                                                                                                                                              • Opcode ID: 5a5f4b846ff8d1fd1bb98f9d71d4c3c30ec096eb1b25e09bac97bcd3c9b8234d
                                                                                                                                                                                                                              • Instruction ID: fb41076660bbb84e3a7f3ff86af748c7eb8638140fa994464c30b42e6a9016db
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a5f4b846ff8d1fd1bb98f9d71d4c3c30ec096eb1b25e09bac97bcd3c9b8234d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C2510473709A4591EF09CBA9ED1831DA362FB86FC5F84855ACD1A43724FE7AC042C342
                                                                                                                                                                                                                              Function 655D0ED0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Too many format strings, xrefs: 655D0F0D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dealloc$Err_FormatObject_StringUnicode_
                                                                                                                                                                                                                              • String ID: Too many format strings
                                                                                                                                                                                                                              • API String ID: 3094464462-2091874682
                                                                                                                                                                                                                              • Opcode ID: 8ecc362eeeae3031d3853dfdb037f5cf9596a269805bca0aadc7f07d8bf57519
                                                                                                                                                                                                                              • Instruction ID: cffc5d4519a9c6bbaeab9374ceb2cfbe3f3c88da2151f6f58aeb9a42cad418ba
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8ecc362eeeae3031d3853dfdb037f5cf9596a269805bca0aadc7f07d8bf57519
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C351C133B09A8682DF049B6AE948729F372B744BC9F544621D91A07B28EF3AC155C349
                                                                                                                                                                                                                              Function 655D1850 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 145COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dealloc$ItemMethod_Tuple_$BuildFunction_NameQualSubtypeType_ValueWith
                                                                                                                                                                                                                              • String ID: (O)
                                                                                                                                                                                                                              • API String ID: 593819998-4232840684
                                                                                                                                                                                                                              • Opcode ID: 4ae0ab5d2995b3382f710b58743867f3de19a9a02ca8dd030bdda331dff44141
                                                                                                                                                                                                                              • Instruction ID: fb9936db6f1f9c4326b8201d288c1579a589247edaa78d33f6bd71456b2b2e72
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4ae0ab5d2995b3382f710b58743867f3de19a9a02ca8dd030bdda331dff44141
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33518F3330AE5086EB15CF6AEE48769B3A2FB85BD5F498214DE5A07B14EF39C094C345
                                                                                                                                                                                                                              Function 655C8630 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 120COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • EOF read where not expected, xrefs: 655C8797
                                                                                                                                                                                                                              • read() returned too much data: %zd bytes requested, %zd returned, xrefs: 655C872B
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$Mem_Memory$BufferBuffer_CallDeallocFillFormatFromInfoMallocMethodNumber_Object_OccurredReallocSsize_tView_
                                                                                                                                                                                                                              • String ID: EOF read where not expected$read() returned too much data: %zd bytes requested, %zd returned
                                                                                                                                                                                                                              • API String ID: 4179280635-3742967138
                                                                                                                                                                                                                              • Opcode ID: 194f87807741f0c34e6dbb7314b1afdd82c691fc7cd9bf7285fd63d2adb92d28
                                                                                                                                                                                                                              • Instruction ID: d3ae365c7c3282ad903955cfcd6d26b2f1e66998228509a80dc8009a3851d460
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 194f87807741f0c34e6dbb7314b1afdd82c691fc7cd9bf7285fd63d2adb92d28
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 84417122305E0485EB018BA6ED0835923A2B744FEAF844629DD2D57B94EE7EC59AC303
                                                                                                                                                                                                                              Function 00007FF611308820 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99processsynchronizationCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _get_osfhandle$Process_fileno$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                              • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                              • API String ID: 2399235724-3524285272
                                                                                                                                                                                                                              • Opcode ID: 2bb69f242d9541d69d1b049c92316138750a043074f1ee99989ea41868e2982c
                                                                                                                                                                                                                              • Instruction ID: c0089ae21c8403b2a97eafd0122c2a33b277d6032b14fe060f121b25def22bf8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2bb69f242d9541d69d1b049c92316138750a043074f1ee99989ea41868e2982c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3D414432A08B8145EB609B64F8557AA73A4EB857B4F404335EAAD877D8EF7CD084C740
                                                                                                                                                                                                                              Function 655DF8C0 Relevance: 22.8, APIs: 9, Strings: 6, Instructions: 254COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$memcmp$malloc
                                                                                                                                                                                                                              • String ID: `ee$hash != NULL$key != NULL$sig != NULL$src/pk/rsa/rsa_verify_hash.c$stat != NULL
                                                                                                                                                                                                                              • API String ID: 2896619906-678541687
                                                                                                                                                                                                                              • Opcode ID: 57015f10cfcf0e2d0b6b407767d9478432e745d572775ad3dbcb72667ea8a106
                                                                                                                                                                                                                              • Instruction ID: f1036e4ee06a4e641b9f6741a27c89d3f922c6456eae0a77e18938b2a578b4bf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 57015f10cfcf0e2d0b6b407767d9478432e745d572775ad3dbcb72667ea8a106
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: ACB1B1733086819AE760CF49E84879AF7A1F784BC8F404625DE894BB58EB7DC945CF44
                                                                                                                                                                                                                              Function 00007FF6113049F0 Relevance: 22.7, APIs: 7, Strings: 8, Instructions: 203stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocstrcmpstrncmp
                                                                                                                                                                                                                              • String ID: _MEIPASS2$dev$hash_seed$optimize$pyi-$unbuffered$utf8$verbose
                                                                                                                                                                                                                              • API String ID: 3864021093-2470803696
                                                                                                                                                                                                                              • Opcode ID: 451d73b7ff344c03704b212d97ce530da948a4f6c025c6dc93e866c2767be9a3
                                                                                                                                                                                                                              • Instruction ID: 43dd1adee11f9c95113bd6cf3815a60c00f1d351f4db543391c28fa7c551f445
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 451d73b7ff344c03704b212d97ce530da948a4f6c025c6dc93e866c2767be9a3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0C819562E0CE4256FF65DB22A40437A6AE9AF45F78F448035CA4DC66CDDF7CE6858304
                                                                                                                                                                                                                              Function 655DDE20 Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 319COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocfree
                                                                                                                                                                                                                              • String ID: A != NULL$B != NULL$C != NULL$P != NULL$kA != NULL$kB != NULL$modulus != NULL$src/pk/ecc/ltc_ecc_map.c$src/pk/ecc/ltc_ecc_mul2add.c
                                                                                                                                                                                                                              • API String ID: 306872129-190324370
                                                                                                                                                                                                                              • Opcode ID: e375381a120fc8b5a5e114f26221754611825eca5b83d7d3e827debef17e50af
                                                                                                                                                                                                                              • Instruction ID: 7baffb5c80e8a2247a922129541a099a2ee65f5305fd1ca1082a725728552f0e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e375381a120fc8b5a5e114f26221754611825eca5b83d7d3e827debef17e50af
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CAC18B33708AD186D760CF5AE848B9AF765F789BD9F454122EE8A97708EF78C844C740
                                                                                                                                                                                                                              Function 6563FCE0 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 283memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • VirtualProtect.KERNEL32(?,?,?,?,?,?,655C1278), ref: 6563FE0D
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Unknown pseudo relocation bit size %d., xrefs: 6563FF7A
                                                                                                                                                                                                                              • 4ee, xrefs: 6563FD39
                                                                                                                                                                                                                              • Unknown pseudo relocation protocol version %d., xrefs: 6563FF8E
                                                                                                                                                                                                                              • 4ee, xrefs: 6563FD40
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                                                                                                              • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$4ee$4ee
                                                                                                                                                                                                                              • API String ID: 544645111-328321681
                                                                                                                                                                                                                              • Opcode ID: 97a76bfdf81d043948e849395f02b61ebaff46b729ca689dc235c5fe8d44b0c9
                                                                                                                                                                                                                              • Instruction ID: da8817154234a2b2dde872e0848d9477af4e8362c05236e16726acfd7fed9f27
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 97a76bfdf81d043948e849395f02b61ebaff46b729ca689dc235c5fe8d44b0c9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 48914631B0466086EB14CF75D941B5EA362B7A57B8F90D525CE1D8BFA8EB3EC486C301
                                                                                                                                                                                                                              Function 00007FFD930B1C1C Relevance: 21.3, APIs: 5, Strings: 9, Instructions: 267stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmp$strncmp
                                                                                                                                                                                                                              • String ID: ..\s\crypto\asn1\asn_mime.c$application/pkcs7-mime$application/pkcs7-signature$application/x-pkcs7-mime$application/x-pkcs7-signature$boundary$content-type$multipart/signed$type:
                                                                                                                                                                                                                              • API String ID: 1244041713-3630080479
                                                                                                                                                                                                                              • Opcode ID: fe6ee42ba66115c3f582b9304316164a699994161a53c33d26c7d699cf67fd0c
                                                                                                                                                                                                                              • Instruction ID: b5fdb11cbf79f373bbcadbd551289d0a76a5debff91ac5ece493944d10d13c22
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe6ee42ba66115c3f582b9304316164a699994161a53c33d26c7d699cf67fd0c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 70C1BB22B0C64281FE34EFD194616BD2369AF81788F94803AD94D3779AEF3CE255E300
                                                                                                                                                                                                                              Function 655C1A30 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 170COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyUnicode_AsUTF8.PYTHON311 ref: 655C1A96
                                                                                                                                                                                                                              • PyModule_GetDict.PYTHON311 ref: 655C1AAD
                                                                                                                                                                                                                              • PyDict_GetItemString.PYTHON311 ref: 655C1AC6
                                                                                                                                                                                                                              • PyCFunction_GetSelf.PYTHON311 ref: 655C1AD4
                                                                                                                                                                                                                              • PyErr_Format.PYTHON311 ref: 655C1B3A
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DictDict_Err_FormatFunction_ItemModule_SelfStringUnicode_
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$__dict__$__pyarmor__$protection exception (%d)
                                                                                                                                                                                                                              • API String ID: 3090064410-629680938
                                                                                                                                                                                                                              • Opcode ID: e579b2d604af143ecd6b32f8bc8f366ca8e2c428553cc24737c77ac891aa6da4
                                                                                                                                                                                                                              • Instruction ID: 92d1ae53f7e81d4bab4a5921117661733e72ff78fc0139488ccc31b0df7701a0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e579b2d604af143ecd6b32f8bc8f366ca8e2c428553cc24737c77ac891aa6da4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3A51E732705B4481EF058B96EC9876827A2FB84FD9F8944B9DE1E07760EE39C095C741
                                                                                                                                                                                                                              Function 00007FFD930B1F69 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 135COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: ..\s\crypto\rand\randfile.c$Filename=$i
                                                                                                                                                                                                                              • API String ID: 0-1799673945
                                                                                                                                                                                                                              • Opcode ID: 9b4ea193b028727d5cf33481ab8e51e1a79f6630d4abdc56d1a885e2ca4d3d0c
                                                                                                                                                                                                                              • Instruction ID: ef9b6ef9df98d002d4589ebcb250b149a63381fe333723258381d70978b9cfcd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9b4ea193b028727d5cf33481ab8e51e1a79f6630d4abdc56d1a885e2ca4d3d0c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F51C721B0CA4786FA30EB96D86167A73A9FF84B44F800139D94E67695EF3DF905CB10
                                                                                                                                                                                                                              Function 655D0D00 Relevance: 21.1, APIs: 14, Instructions: 93COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$Restore$DeallocExceptionException_FetchNormalize$Back_ContextEval_FrameHereOccurredTraceTraceback
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4214459649-0
                                                                                                                                                                                                                              • Opcode ID: dc74e0e63e81e9e27f6e8a3395405a33c25d15d68652cb0286dce22e0a72b852
                                                                                                                                                                                                                              • Instruction ID: f0e8edab5bc0cd13362d2990bc35216600e3409fcea9e0b782143a2002b0da7c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc74e0e63e81e9e27f6e8a3395405a33c25d15d68652cb0286dce22e0a72b852
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 31312666309FC095DA20DB1AFC1439AB762FB86BD1F848016EE8D43B28DF39C045C706
                                                                                                                                                                                                                              Function 00007FF611302B90 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 71windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _wcsdupfree$DeleteDestroyDialogHandleIconIndirectModuleObjectParammemset
                                                                                                                                                                                                                              • String ID: Unhandled exception in script
                                                                                                                                                                                                                              • API String ID: 3963799495-2699770090
                                                                                                                                                                                                                              • Opcode ID: 63ee56fe181a1917596a2b7ec1c70eb69a51c0cc73ba7970fc3e78cbc600a575
                                                                                                                                                                                                                              • Instruction ID: a23022fd173faae4c7dabd0f3f57d8b74b144ae53c7ae6608eb2e7cf232be820
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 63ee56fe181a1917596a2b7ec1c70eb69a51c0cc73ba7970fc3e78cbc600a575
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE215136B09E8581EB65EB62B8546EB6368FBC9FA0F440135EE4E87B49DE3CD045C740
                                                                                                                                                                                                                              Function 655D1E90 Relevance: 19.6, APIs: 13, Instructions: 96memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Process$AdaptersAddressesAllocFree$inet_ntoa
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4108032510-0
                                                                                                                                                                                                                              • Opcode ID: 0aea62c4e8033b316e9607a811da02806847fb27f1b58047ef8fd754bcad2c59
                                                                                                                                                                                                                              • Instruction ID: fac0c3534c80afd2e6656ffc6296d38cc0b97535dbf9eddbf443358b8ff35549
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0aea62c4e8033b316e9607a811da02806847fb27f1b58047ef8fd754bcad2c59
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6221E41331564546EB04DBABAC04B5AE292BB89BD4F088335BD1D87398EF38C442C355
                                                                                                                                                                                                                              Function 00007FF611306D80 Relevance: 18.1, APIs: 9, Strings: 3, Instructions: 131stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlenstrncpy$callocfreememcpy
                                                                                                                                                                                                                              • String ID: SPLASH: Cannot extract requirement %s.$SPLASH: Cannot find requirement %s in archive.$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 4189425833-927121926
                                                                                                                                                                                                                              • Opcode ID: 3deb22c876463e9c63b73cd2c22ece139e26c11ddae39d3f8cf6f8d0c71dafd8
                                                                                                                                                                                                                              • Instruction ID: 507705ac32582b1ea7933cbfe9e5517200da6e8b4514d1ff1b5df0d82a5cbdd0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3deb22c876463e9c63b73cd2c22ece139e26c11ddae39d3f8cf6f8d0c71dafd8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3641C592708E4255EB18EA22D9042FB63A9BF45FE4F844135EE1DC778EDE2CE656C300
                                                                                                                                                                                                                              Function 00007FF611306B90 Relevance: 18.1, APIs: 10, Strings: 2, Instructions: 114stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcpystrncpy$malloc$callocfree
                                                                                                                                                                                                                              • String ID: Cannot allocate memory for necessary files.$_MEIPASS2
                                                                                                                                                                                                                              • API String ID: 1819673767-1389504347
                                                                                                                                                                                                                              • Opcode ID: 1c1aae830d7a0291694ed80a20a0afa746c84ec70af25d8933fc9614f42266ba
                                                                                                                                                                                                                              • Instruction ID: 1dc04f59f199458a8da713bedb3bcb0f6aec249f024fcfc4dd4aec9ef68358b0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1c1aae830d7a0291694ed80a20a0afa746c84ec70af25d8933fc9614f42266ba
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8341E4A2B05A0657EB18EA22D9442E9B3A9FB44FA0F544530DF1D87B89EF7CE1528300
                                                                                                                                                                                                                              Function 655D1B10 Relevance: 18.1, APIs: 12, Instructions: 111memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Process$Free$Alloc$AdaptersAddressesmemcpy
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1739390247-0
                                                                                                                                                                                                                              • Opcode ID: ee3706aff2a730a5c98467d6ffc04d310d8ab49b36e1cd75808933f9135d73bf
                                                                                                                                                                                                                              • Instruction ID: 18e1c2b6d05c5c84bc23980641701ee03a9b06968de6fc720af2fda85320fa74
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ee3706aff2a730a5c98467d6ffc04d310d8ab49b36e1cd75808933f9135d73bf
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6431A8333056418AEB45DF7AA854B6DA392A789BD8F488535EE1947714FE38C582C704
                                                                                                                                                                                                                              Function 655DD3C0 Relevance: 18.1, APIs: 8, Strings: 4, Instructions: 99stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmp
                                                                                                                                                                                                                              • String ID: `ee$aes$name != NULL$src/misc/crypt/crypt_find_hash.c
                                                                                                                                                                                                                              • API String ID: 1004003707-1299439242
                                                                                                                                                                                                                              • Opcode ID: 601caa24f6cdf50978214d2e49c8100922ea2f7feede72d58faa9c819481f6bb
                                                                                                                                                                                                                              • Instruction ID: 387fc27251f71be181105881c74fa1424ccc48856e241ea37ac5113f0c37e7be
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 601caa24f6cdf50978214d2e49c8100922ea2f7feede72d58faa9c819481f6bb
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F931A62330628655FF28CE56C5D87B9A315FB447D8F0082258E2B8FA04EF68E209C714
                                                                                                                                                                                                                              Function 655D3AD0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 117stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: freemallocmemcpystrchrstrlen
                                                                                                                                                                                                                              • String ID: and,$http://$local$or,
                                                                                                                                                                                                                              • API String ID: 3771145599-2506292620
                                                                                                                                                                                                                              • Opcode ID: 6994832533a56367005cc6e05215c8dd98345101bb0ad32382b69461a8beae47
                                                                                                                                                                                                                              • Instruction ID: 41fba646db815fbe9c58dbcf12320cd4301aed40134d21315c2625a3b0f9d6c8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6994832533a56367005cc6e05215c8dd98345101bb0ad32382b69461a8beae47
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7931073330965890FA51CF1E9908369E751FB42BF8F998B248D39177E4EB3AC04AC349
                                                                                                                                                                                                                              Function 00007FF611302500 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                              • String ID: P%
                                                                                                                                                                                                                              • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                              • Opcode ID: 6e54ce7222580e4a214d1a9fc401257ee609a80b666226e2997e335eb7f2f95f
                                                                                                                                                                                                                              • Instruction ID: bbe6ee1b6d3a3a77068812d9bbd6c62cec49c7f5faf5a80af74b795f75b0360c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e54ce7222580e4a214d1a9fc401257ee609a80b666226e2997e335eb7f2f95f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 47418776214BA186D7208F36E408779B7A5F788F99F084231EE8987B59EF3CD145CB20
                                                                                                                                                                                                                              Function 655C9C70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • NULL object in marshal data for list, xrefs: 655CB058
                                                                                                                                                                                                                              • bad marshal data (list size out of range), xrefs: 655CAAD1
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_List_Occurred
                                                                                                                                                                                                                              • String ID: NULL object in marshal data for list$bad marshal data (list size out of range)
                                                                                                                                                                                                                              • API String ID: 1902535023-3453879413
                                                                                                                                                                                                                              • Opcode ID: 5054c606a19ee87e08223c5bad087505e4feedeb9dbec1fdd4d585c3152e7d60
                                                                                                                                                                                                                              • Instruction ID: 3eb2e04c3e8eee41823eab29957df6be2ea918cd1ce7c48821b428b5a18bb850
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5054c606a19ee87e08223c5bad087505e4feedeb9dbec1fdd4d585c3152e7d60
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24317A31709B41C6EA00DF95E89871937A2FB85B89F448868DE4E47714DF39D489C382
                                                                                                                                                                                                                              Function 655C9DE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 73COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • NULL object in marshal data for tuple, xrefs: 655CAEF9
                                                                                                                                                                                                                              • bad marshal data (tuple size out of range), xrefs: 655CAC8E
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_OccurredTuple_
                                                                                                                                                                                                                              • String ID: NULL object in marshal data for tuple$bad marshal data (tuple size out of range)
                                                                                                                                                                                                                              • API String ID: 3674511531-3094253248
                                                                                                                                                                                                                              • Opcode ID: 499bab45598a42969fe488b6349a7b18071ec3ea50fd777e284b739c6b91639e
                                                                                                                                                                                                                              • Instruction ID: 6ca57f78b36797b5ebfbb6a218376e1ae92de58f06977249860dec5c12353a54
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 499bab45598a42969fe488b6349a7b18071ec3ea50fd777e284b739c6b91639e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 32217C31709B4186EA10DFA5E89C71937B1BB85B89F42886CDE0E47314EF39D489C383
                                                                                                                                                                                                                              Function 655D8510 Relevance: 16.9, APIs: 3, Strings: 8, Instructions: 356stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen
                                                                                                                                                                                                                              • String ID: 8$?$?$@$MD5$in != NULL$md != NULL$src/hashes/md5.c
                                                                                                                                                                                                                              • API String ID: 39653677-3461814546
                                                                                                                                                                                                                              • Opcode ID: 936d5757294c818ea727aa664ef8605e1bbd9b229f9b7b278c9f300408979052
                                                                                                                                                                                                                              • Instruction ID: 4e60605f0b7ca03fe429f3007bf1b1140834b144d728e05c33a4ac8302d04884
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 936d5757294c818ea727aa664ef8605e1bbd9b229f9b7b278c9f300408979052
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F6D1ECB36082818AE701CB5EE458B6EFFA1F392388F446609DE821BB44D77ED445CB47
                                                                                                                                                                                                                              Function 655DD840 Relevance: 16.7, APIs: 8, Strings: 3, Instructions: 177COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcmp
                                                                                                                                                                                                                              • String ID: `ee$hash != NULL$src/misc/crypt/crypt_register_hash.c
                                                                                                                                                                                                                              • API String ID: 1475443563-17379175
                                                                                                                                                                                                                              • Opcode ID: 432f9ad7a351c0998ef8b1f23f89b15d3faec8f5b2df927045c9096e21228a0e
                                                                                                                                                                                                                              • Instruction ID: 171a1370a5b34d404517d46e077ba0088aa323d6a3d6f20e4c75ec675dce37e3
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 432f9ad7a351c0998ef8b1f23f89b15d3faec8f5b2df927045c9096e21228a0e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E061D93330575496E760CF2AE88479AB364F304BD8F448225CF9A87B54DF39E15AC758
                                                                                                                                                                                                                              Function 655C9E10 Relevance: 16.6, APIs: 11, Instructions: 85COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dict_$AppendDeallocItemList_
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2970173465-0
                                                                                                                                                                                                                              • Opcode ID: 59f39ef1215198a9324b581995806f1b1ea9b298c75c10eaeecaa02ef7c6e062
                                                                                                                                                                                                                              • Instruction ID: aba75e0d3f049d7e700fed2bd7b4bec74312637f76618785c1c7d375e704792a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59f39ef1215198a9324b581995806f1b1ea9b298c75c10eaeecaa02ef7c6e062
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D531387130AB4186EA458FA6EC6C70977A5BB8AF99F4954ACCE4E47B00DE3DD041C343
                                                                                                                                                                                                                              Function 655D2290 Relevance: 16.6, APIs: 11, Instructions: 78memorynetworkCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Heap$Process$Free$Alloc$NetworkParams
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3483679945-0
                                                                                                                                                                                                                              • Opcode ID: a36a2779e4b6ddafb03d1c7d0570e49966fa4ca10da643109c815580eb6d0d7a
                                                                                                                                                                                                                              • Instruction ID: eb208fc36bc46b08561c5562bd16e1b308105ec987d7b028fdb81a631c605eed
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a36a2779e4b6ddafb03d1c7d0570e49966fa4ca10da643109c815580eb6d0d7a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D111E953305A4594EA14DBBB7C0476AD6926FCABD8F488236AD2D573A4EE3CC442C344
                                                                                                                                                                                                                              Function 655C4D71 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145threadCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyList_New.PYTHON311 ref: 655CE71B
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyErr_Occurred.PYTHON311 ref: 655CE73A
                                                                                                                                                                                                                                • Part of subcall function 655CE6E0: PyMem_Free.PYTHON311 ref: 655CE768
                                                                                                                                                                                                                              • PyThreadState_Get.PYTHON311 ref: 655CF987
                                                                                                                                                                                                                              • _PyDict_GetItemWithError.PYTHON311 ref: 655CF9AA
                                                                                                                                                                                                                              • _PyObject_FastCall.PYTHON311 ref: 655CFA1B
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655CFA4B
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655CFA83
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyTuple_Size.PYTHON311 ref: 655C8281
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyTuple_New.PYTHON311 ref: 655C828D
                                                                                                                                                                                                                                • Part of subcall function 655C8260: _PyObject_LookupAttr.PYTHON311 ref: 655C830C
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyObject_GetAttr.PYTHON311 ref: 655C831E
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyModule_GetFilenameObject.PYTHON311 ref: 655C834A
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyUnicode_FromString.PYTHON311 ref: 655C835A
                                                                                                                                                                                                                                • Part of subcall function 655C8260: _PyErr_Clear.PYTHON311(?,?,00000000,?,00000000,?,?,?,?,?,655CFAFF), ref: 655C8394
                                                                                                                                                                                                                                • Part of subcall function 655C8260: PyErr_SetImportError.PYTHON311 ref: 655C83B9
                                                                                                                                                                                                                                • Part of subcall function 655C8260: _Py_Dealloc.PYTHON311 ref: 655C83D8
                                                                                                                                                                                                                              • _PyLong_AsInt.PYTHON311 ref: 655CFAB8
                                                                                                                                                                                                                              • PyImport_ImportModuleLevelObject.PYTHON311 ref: 655CFADF
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655CFB11
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dealloc$Err_Object_$AttrErrorImportObjectTuple_$CallClearDict_FastFilenameFreeFromImport_ItemLevelList_Long_LookupMem_ModuleModule_OccurredSizeState_StringThreadUnicode_With
                                                                                                                                                                                                                              • String ID: __import__ not found
                                                                                                                                                                                                                              • API String ID: 2133401641-2199325508
                                                                                                                                                                                                                              • Opcode ID: 9ac40b60e857652f1246002a6ed900096e3607ad86d5f065cc6ece918d8e19b4
                                                                                                                                                                                                                              • Instruction ID: 248bebcaecf54c11f3edf841a974ff42c383895df94ad4b6bbf72a118cd31454
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9ac40b60e857652f1246002a6ed900096e3607ad86d5f065cc6ece918d8e19b4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE519C72309E4482EB418F66ED44759B7A1FB89FE9F44806AEE5A07B24DF39C492C301
                                                                                                                                                                                                                              Function 655C1660 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$FormatOccurred
                                                                                                                                                                                                                              • String ID: %s (%d:%d)
                                                                                                                                                                                                                              • API String ID: 4038069558-1595188566
                                                                                                                                                                                                                              • Opcode ID: 3203d6e74869b537bf337df77313df74bd09d28397d795c1a8892745d5c82633
                                                                                                                                                                                                                              • Instruction ID: c8a543375930f68ffecc09195063f67851b87a3658f86f762ceac62ff4a4ce04
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3203d6e74869b537bf337df77313df74bd09d28397d795c1a8892745d5c82633
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A41E472719B8482DF44CB99E85836E77A1FB86BD5F885069DE4E07B24CE3DC085C741
                                                                                                                                                                                                                              Function 65640230 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: signal
                                                                                                                                                                                                                              • String ID: CCG
                                                                                                                                                                                                                              • API String ID: 1946981877-1584390748
                                                                                                                                                                                                                              • Opcode ID: ac37c62943570249b15e7850ea290f0b562f8858747f7cd5229a97c59afef0a5
                                                                                                                                                                                                                              • Instruction ID: 50235eae97ad12a55b58c389a1256f7646d6a79f6dd2cbfe0932b1f8b682f4e5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac37c62943570249b15e7850ea290f0b562f8858747f7cd5229a97c59afef0a5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE316F3070942287EB66CAB9545036918027BFA339F24CB25C97ECFBD6CEAC95C4C216
                                                                                                                                                                                                                              Function 655C98B0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C98C0
                                                                                                                                                                                                                              • PyUnicode_DecodeUTF8.PYTHON311 ref: 655CA15F
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • surrogatepass, xrefs: 655CA155
                                                                                                                                                                                                                              • bad marshal data (string size out of range), xrefs: 655CAA6E
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DecodeErr_OccurredUnicode_
                                                                                                                                                                                                                              • String ID: bad marshal data (string size out of range)$surrogatepass
                                                                                                                                                                                                                              • API String ID: 1138423624-4021928140
                                                                                                                                                                                                                              • Opcode ID: 186e0761dd20b8e89e334bfe2bded994a7e05cd1ccc3dc244a1ddd59fb7ca03b
                                                                                                                                                                                                                              • Instruction ID: 91838017c88b118c5f3c9ff854cf1866af30506d117ec46b5a44f2cd9a62909d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 186e0761dd20b8e89e334bfe2bded994a7e05cd1ccc3dc244a1ddd59fb7ca03b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4031A532309A40C6EB11CF55E858B9A77B6FB85B99F45C86CCE4A07714DF38D485C782
                                                                                                                                                                                                                              Function 00007FFD930B23D3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindowwcsstr
                                                                                                                                                                                                                              • String ID: Service-0x$_OPENSSL_isservice
                                                                                                                                                                                                                              • API String ID: 459917433-1672312481
                                                                                                                                                                                                                              • Opcode ID: bc225b995bbff2d3b119e7081b5c779a5c3234c2f77d3222796a288c2c9d01dd
                                                                                                                                                                                                                              • Instruction ID: 37dbe19f660ff0eb9b9767c55f3a4335bfc650b7535908ff8092753cb0603671
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bc225b995bbff2d3b119e7081b5c779a5c3234c2f77d3222796a288c2c9d01dd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6841A622709B8295FB74AFA4D86026823A8EF49774F944735E97D677E8DF2CE104C300
                                                                                                                                                                                                                              Function 655C7FA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$FetchFormatFromObject_RestoreWindowsstrerror
                                                                                                                                                                                                                              • String ID: %s (%d:%d)
                                                                                                                                                                                                                              • API String ID: 2858978339-1595188566
                                                                                                                                                                                                                              • Opcode ID: e85c47f1f589f6ea68a2032e06490bc3c68f2969b86d31e1b353e49a83f193b9
                                                                                                                                                                                                                              • Instruction ID: f319ae636bef93743a53fb1d3f3c32ce04b2d9065d0f4f3d62627e49fcfd6743
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e85c47f1f589f6ea68a2032e06490bc3c68f2969b86d31e1b353e49a83f193b9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33219232705F5481DB009B59EC543997762FB86B96F85802AEE4E27764CF3EC446C782
                                                                                                                                                                                                                              Function 655CE6E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 58fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • NULL object in marshal data for object, xrefs: 655CE7CE
                                                                                                                                                                                                                              • XXX readobject called with exception set, xrefs: 655CE79D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$Occurred$FreeList_Mem_Stringfwrite
                                                                                                                                                                                                                              • String ID: NULL object in marshal data for object$XXX readobject called with exception set
                                                                                                                                                                                                                              • API String ID: 4281374468-3392712392
                                                                                                                                                                                                                              • Opcode ID: 7e3af20d15800fde2b6c589b1e43a9e7a218940ded1b9ba38b436a05a85b144f
                                                                                                                                                                                                                              • Instruction ID: 52a8a6e22c914ef300cd0827caafff511dfcd167662ca4fddad92af67559c5f0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7e3af20d15800fde2b6c589b1e43a9e7a218940ded1b9ba38b436a05a85b144f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E021DC3120AF8582EB41CB90FC4931977E1FB89B89F504428EA8E43B68DF3EC006C742
                                                                                                                                                                                                                              Function 00007FF611308CD0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharErrorFormatLastMessageMultiWide
                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                              • API String ID: 1653872744-2573406579
                                                                                                                                                                                                                              • Opcode ID: 024fbe4156dcd0bd8b1afa62f143db975c9d56f4e4c52d1d88309cd898284ba8
                                                                                                                                                                                                                              • Instruction ID: c9ac70e996a78456ca74bd52e1d2cbdda75d1d182bfa108752427fcce29453be
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 024fbe4156dcd0bd8b1afa62f143db975c9d56f4e4c52d1d88309cd898284ba8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F421A571E0CE0281F720AB14F8583AA23A8BF55BB4F844534EA4DC66ACEF3CD549C700
                                                                                                                                                                                                                              Function 655DDAD0 Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 158COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • src/misc/crypt/crypt_register_prng.c, xrefs: 655DDCFF
                                                                                                                                                                                                                              • prng != NULL, xrefs: 655DDD06
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcmp
                                                                                                                                                                                                                              • String ID: prng != NULL$src/misc/crypt/crypt_register_prng.c
                                                                                                                                                                                                                              • API String ID: 1475443563-58737364
                                                                                                                                                                                                                              • Opcode ID: a913128a9f4e728073ed94bef177e1e2b2bedfa6e1bb2cde48caf202d923e6ee
                                                                                                                                                                                                                              • Instruction ID: 1317e3ddf535fc72a45fc22366ad2e50efafd354bfd7698dd3f07dc3c7c85764
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a913128a9f4e728073ed94bef177e1e2b2bedfa6e1bb2cde48caf202d923e6ee
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71518F33304B98A6E750CF16D888B9EB369F748BD4F858225CF2987750EB78D259CB14
                                                                                                                                                                                                                              Function 655DD510 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 108stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmp
                                                                                                                                                                                                                              • String ID: name != NULL$src/misc/crypt/crypt_find_prng.c
                                                                                                                                                                                                                              • API String ID: 1004003707-2030105502
                                                                                                                                                                                                                              • Opcode ID: bd664a6d9f0a0808b36262ff49592f962540af911b4a605302155891ce701580
                                                                                                                                                                                                                              • Instruction ID: 5bcb82b6c15460d08124199243efe65b55dc33dccfe919d23b4368fc9eea5abc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bd664a6d9f0a0808b36262ff49592f962540af911b4a605302155891ce701580
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4931C62331A58649EF18DE5ADAD83B9A311FF45BDCF0042258F2B4BE08EB28D206C754
                                                                                                                                                                                                                              Function 655DD270 Relevance: 15.1, APIs: 8, Strings: 2, Instructions: 99stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • name != NULL, xrefs: 655DD3A8
                                                                                                                                                                                                                              • src/misc/crypt/crypt_find_cipher.c, xrefs: 655DD3A1
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmp
                                                                                                                                                                                                                              • String ID: name != NULL$src/misc/crypt/crypt_find_cipher.c
                                                                                                                                                                                                                              • API String ID: 1004003707-679692990
                                                                                                                                                                                                                              • Opcode ID: 11dc2316814a17821c6e08e23ef36a2eee01094678e651aac4b8e3b933b740c3
                                                                                                                                                                                                                              • Instruction ID: f7e750e6fedafc293297a7829d9e1343767aa832e7321d741072baed43f8b6ee
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 11dc2316814a17821c6e08e23ef36a2eee01094678e651aac4b8e3b933b740c3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2231A72331A5C699FF18DE56C9D87BEA315FF44BD8F0086258E278BA44EF28D205C718
                                                                                                                                                                                                                              Function 00007FF6113086B0 Relevance: 15.1, APIs: 10, Instructions: 75fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fclose$clearerrferror$_wfopenfreadfwrite
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4075948245-0
                                                                                                                                                                                                                              • Opcode ID: de543994853625e5123b511a0ad74e2fad549e823485704da97f86f2286d7e77
                                                                                                                                                                                                                              • Instruction ID: dad51293285be833ac92c51cc72ebd40228db87bdf95f3a57c87f9ce257a7fda
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: de543994853625e5123b511a0ad74e2fad549e823485704da97f86f2286d7e77
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4D21F310E09A4341FA29A6226A193F942D90F46FF0E5801B4ED1EDB7CEEE2CE9524341
                                                                                                                                                                                                                              Function 00007FF611312D4B Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 176stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwprintf$___lc_codepage_func___mb_cur_max_funcfputwcmemsetstrlen
                                                                                                                                                                                                                              • String ID: %*.*S$%-*.*S$%.*S
                                                                                                                                                                                                                              • API String ID: 1485978544-2115465065
                                                                                                                                                                                                                              • Opcode ID: 5a4758fc2b7250ab57d84d915ac7ea9a8d289e4afafd195f03aed32c1a1e0ffa
                                                                                                                                                                                                                              • Instruction ID: 75f8b3f023b56bbab9ca2e055c262703fd6de8f728d65a6eca5afd5a5e8b14ab
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5a4758fc2b7250ab57d84d915ac7ea9a8d289e4afafd195f03aed32c1a1e0ffa
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C781D776A04B498EEB14CF6AC8806AC77B4F748FA8F118525EE5D87B58DF38D510CB50
                                                                                                                                                                                                                              Function 655C13C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 167COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ObjectSizeSys_Unicode_getenv
                                                                                                                                                                                                                              • String ID: LANG$PYARMOR_LANG$_PARLANG
                                                                                                                                                                                                                              • API String ID: 223123148-1822377752
                                                                                                                                                                                                                              • Opcode ID: 2ea2cf00a8b36c58963a17aa7ab993bd4ec67035b6483d9c510a7495e2f72678
                                                                                                                                                                                                                              • Instruction ID: 3e66d71d10d4bf1d9fc5e0ad2051b154bf26aca46c49c87bfac076b794b57818
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ea2cf00a8b36c58963a17aa7ab993bd4ec67035b6483d9c510a7495e2f72678
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CD5138A260C6E085EB01CB95D5D43A93BB3B742F89F88C0DEDA9E07351D729C499C752
                                                                                                                                                                                                                              Function 00007FFD930B3779 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 85stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strcmpstrncmpstrtoul
                                                                                                                                                                                                                              • String ID: MASK:$default$nombstr$pkix$utf8only
                                                                                                                                                                                                                              • API String ID: 1175158921-3483942737
                                                                                                                                                                                                                              • Opcode ID: 56a8b705b4d859711014d430f94cbbc3222095bc84f144be5c70752352c183a7
                                                                                                                                                                                                                              • Instruction ID: e729a501e48f01778bb3eb8354783167159e9ab22c8a4bf107bc1ec0c5fa5ca7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 56a8b705b4d859711014d430f94cbbc3222095bc84f144be5c70752352c183a7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 35315523B1C68186FB719B9DE4607B837A4EB45750F844236EA5EA36A1EF2CE491C700
                                                                                                                                                                                                                              Function 00007FF611308EC0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 64COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                              • API String ID: 1374691127-27947307
                                                                                                                                                                                                                              • Opcode ID: 610e830cc156b7b5144b5e984da796cd542280474a5d718d75e7e6b0456d95c9
                                                                                                                                                                                                                              • Instruction ID: a54531b54b36b916956c4e85298a8d55651bc6033303cff3e661cfbe370874ae
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 610e830cc156b7b5144b5e984da796cd542280474a5d718d75e7e6b0456d95c9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B121B361B09F4284FB10EB65B85437A6299AF85BF4F444639EA4DCB6DDEF7CE1088300
                                                                                                                                                                                                                              Function 00007FF611308DD0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Out of memory.$WideCharToMultiByte$win32_wcs_to_mbs
                                                                                                                                                                                                                              • API String ID: 1374691127-3831141058
                                                                                                                                                                                                                              • Opcode ID: 3053fae4ff6c96a7205fc05c2f0ab597f00dd46bdd9511d4cab0f019121f0fe5
                                                                                                                                                                                                                              • Instruction ID: 2f3b467799820a6602a7dd90b9976d695f1a60aad8dd9ce4870ce1520556efea
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3053fae4ff6c96a7205fc05c2f0ab597f00dd46bdd9511d4cab0f019121f0fe5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5121C031A0CE4684F710AB65B85836A26E9EB45BF4F844239EA4DC66DDEF7CE104C340
                                                                                                                                                                                                                              Function 00007FF6113089F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _errnostrerror$_strdupcalloc
                                                                                                                                                                                                                              • String ID: LOADER: failed to allocate argv_pyi: %s$LOADER: failed to strdup argv[%d]: %s
                                                                                                                                                                                                                              • API String ID: 4278403329-2782260415
                                                                                                                                                                                                                              • Opcode ID: d96aacef9ed84a949530d77edcfedc7950ec38b60155a97baa6cd5d3fb4306df
                                                                                                                                                                                                                              • Instruction ID: ea8c31593786c9a4929a199a3efa107a26e06077b2887bc8933314cb2c822c43
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d96aacef9ed84a949530d77edcfedc7950ec38b60155a97baa6cd5d3fb4306df
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92119021E09E028AFB11AB64E8455B922A9BF45FB0F544134DE1EC3399FF3CA895C340
                                                                                                                                                                                                                              Function 655E7730 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 168COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: malloc
                                                                                                                                                                                                                              • String ID: mask != NULL$seed != NULL$src/pk/pkcs1/pkcs_1_mgf1.c
                                                                                                                                                                                                                              • API String ID: 2803490479-2931318352
                                                                                                                                                                                                                              • Opcode ID: 007d18a35a24888dcf39cfe4df07b7613f2485130eb91db0356d5a04b7ea0b2f
                                                                                                                                                                                                                              • Instruction ID: 6b03929a61ecd4ce8b527f2e326edd5501b55e068084a0c0faaf78ccabebfb04
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 007d18a35a24888dcf39cfe4df07b7613f2485130eb91db0356d5a04b7ea0b2f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: EA51053272C2D446EB11CF369908B7EBF62BB467C8F458054DEA68BB46EB39D506C710
                                                                                                                                                                                                                              Function 655C9920 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyUnicode_FromKindAndData.PYTHON311 ref: 655C9966
                                                                                                                                                                                                                              • PyErr_SetString.PYTHON311 ref: 655CA4D7
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • EOF read where object expected, xrefs: 655CA4CA
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DataErr_FromKindStringUnicode_
                                                                                                                                                                                                                              • String ID: EOF read where object expected
                                                                                                                                                                                                                              • API String ID: 3898585613-3634523442
                                                                                                                                                                                                                              • Opcode ID: 04ca306bd89f918b7f90f971045096d01b4dbce57aefe0c7a7e2d83fe1acdd06
                                                                                                                                                                                                                              • Instruction ID: f10ceccba4cfa7312ef8cac71ec97e1824882466543ffcafdd226683020711f5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 04ca306bd89f918b7f90f971045096d01b4dbce57aefe0c7a7e2d83fe1acdd06
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6931B172308A9086EB11CF54D89CB5A37B6FB84B99F42899CCE4E07354DF38E485D382
                                                                                                                                                                                                                              Function 655C8C70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • marshal data too short, xrefs: 655C8D7C
                                                                                                                                                                                                                              • EOF read where object expected, xrefs: 655C8D29
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_S_string_to_doubleStringmemcpy
                                                                                                                                                                                                                              • String ID: EOF read where object expected$marshal data too short
                                                                                                                                                                                                                              • API String ID: 1651926552-3827827332
                                                                                                                                                                                                                              • Opcode ID: f38f77dd6b9e2ae228d9fa50a2c1b41989e173e465579d058b658c3aa1c4c980
                                                                                                                                                                                                                              • Instruction ID: 9893afe519beb309a5c822026a8bf841d2b62195f40b60ae0ca80469fcebf519
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f38f77dd6b9e2ae228d9fa50a2c1b41989e173e465579d058b658c3aa1c4c980
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A7319362306E0481EF15CF69E8543683361BB54BC9F84866A9E5E0B764DF3CC5A6C383
                                                                                                                                                                                                                              Function 655C3790 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C37ED
                                                                                                                                                                                                                              • _PyObject_CallMethod_SizeT.PYTHON311 ref: 655C37FF
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C380B
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655C3883
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CallDeallocMethod_Object_Size
                                                                                                                                                                                                                              • String ID: %U.%s$close$read
                                                                                                                                                                                                                              • API String ID: 3129687173-1885073756
                                                                                                                                                                                                                              • Opcode ID: aa663db67ea191b5490c2e51e3b0525d23603efdf2b6fc5ee98d59a3f3621397
                                                                                                                                                                                                                              • Instruction ID: 7a98b9dd8726981eaff07f189bdfd600ed0865f17cd7732ce25404e26c2a3b34
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa663db67ea191b5490c2e51e3b0525d23603efdf2b6fc5ee98d59a3f3621397
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D3110872346A1895EA01DF5AFC0839473D2BB05BC6FC9847AAC0907710EF3AC155C342
                                                                                                                                                                                                                              Function 00007FF6113015E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AddressProc$HandleLibraryLoadModule
                                                                                                                                                                                                                              • String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
                                                                                                                                                                                                                              • API String ID: 384173800-1835852900
                                                                                                                                                                                                                              • Opcode ID: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
                                                                                                                                                                                                                              • Instruction ID: 93bfa6b5016b5c9158fa77e4a97cc2c9e01a359e92fd018dc08700346b207ebe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c987cd605a046c4775a246cf352f7a0ef9f3b92eb4b15ad4de75813f5d1440e3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B5017E25A0AE1B95EB25AB15BC505B423A8BF49FF5F884131D80ED736CAF2CE54AC340
                                                                                                                                                                                                                              Function 655C8FA0 Relevance: 12.2, APIs: 8, Instructions: 242fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwrite
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3559309478-0
                                                                                                                                                                                                                              • Opcode ID: 35d53b257ab5d36623af3ede2f7f5326aabfd9c2661b5d44362e3d723fae2bf1
                                                                                                                                                                                                                              • Instruction ID: 4ceffa435346867d23c185757ecf7d9bc08aab45cc780a3b5a10b29e76c7adf3
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 35d53b257ab5d36623af3ede2f7f5326aabfd9c2661b5d44362e3d723fae2bf1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 50917CB2204B4081DB14CFA9D54839973B1F709FE8F54461ADE6E17388DB78D5A1C3C2
                                                                                                                                                                                                                              Function 655C9510 Relevance: 12.2, APIs: 8, Instructions: 175filestringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwrite$S_double_to_stringstrlen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4243900985-0
                                                                                                                                                                                                                              • Opcode ID: e16756779b8a1fc10292522e6c8f00f77a61b77a9032fca392c706517718d5f4
                                                                                                                                                                                                                              • Instruction ID: 7f486fe836997e6953096de4b45e580ce0e0a654669adafa2600e6d000e116f9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e16756779b8a1fc10292522e6c8f00f77a61b77a9032fca392c706517718d5f4
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6151AAA6305B8885DB05CFA5E84839977B1F749FECF54822ACE1E07788EB38D591C381
                                                                                                                                                                                                                              Function 655E1DC0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 127COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: callocfree
                                                                                                                                                                                                                              • String ID: in != NULL$inlen != 0$public_key_len != NULL$src/pk/asn1/der/sequence/der_decode_subject_public_key_info.c
                                                                                                                                                                                                                              • API String ID: 306872129-3913984646
                                                                                                                                                                                                                              • Opcode ID: 1d68fb711517bc7399ea16f3c952ac82f5687450421f59b63b0c312b341e7b4e
                                                                                                                                                                                                                              • Instruction ID: 6bf8326df5b2730deeb7430c2419952d441c9b92cfb700bb3abdf420f54ac495
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1d68fb711517bc7399ea16f3c952ac82f5687450421f59b63b0c312b341e7b4e
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 18415A723096C08AE771CF56E8447DAB7A1F398388F804119EE994BB48EB7DC545CF90
                                                                                                                                                                                                                              Function 00007FF611304EE0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 88COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: %s%c%s$\$_MEIPASS2$base_library.zip$lib-dynload
                                                                                                                                                                                                                              • API String ID: 626452242-1997419384
                                                                                                                                                                                                                              • Opcode ID: 96eac9c964f75bfd1bb261b00fe75da3a025126ccef3a6a625524ed71a1e8126
                                                                                                                                                                                                                              • Instruction ID: 44ee5af7bd6a5a474c5142f417ca8b8884141367ac5cc770c47755df023e3173
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 96eac9c964f75bfd1bb261b00fe75da3a025126ccef3a6a625524ed71a1e8126
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D9313E22A49E8585EB219B54E8403EA6368FB44BA5F444332DE9DD3ADDDF3CE145C740
                                                                                                                                                                                                                              Function 00007FF611309090 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 60COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWide$calloc
                                                                                                                                                                                                                              • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                              • API String ID: 1374691127-876015163
                                                                                                                                                                                                                              • Opcode ID: 9bafd67a9e6ba27ecb336526dea89acf2ec330839c75d6e55779765ab19282cc
                                                                                                                                                                                                                              • Instruction ID: 0e5664dcbc93563f91497ed99be2fcf6e57de179fa3b7750a91c4c411ad677ae
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9bafd67a9e6ba27ecb336526dea89acf2ec330839c75d6e55779765ab19282cc
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 36119061B08E5384FF24EB65A85827912A9AF49BF4F484539DA0DC7AE9EE7CE1048300
                                                                                                                                                                                                                              Function 6563FAE0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • VirtualProtect failed with code 0x%x, xrefs: 6563FC6A
                                                                                                                                                                                                                              • VirtualQuery failed for %d bytes at address %p, xrefs: 6563FCB8
                                                                                                                                                                                                                              • Address %p has no image-section, xrefs: 6563FCC9
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: QueryVirtual
                                                                                                                                                                                                                              • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                                                                                                                                                                              • API String ID: 1804819252-2123141913
                                                                                                                                                                                                                              • Opcode ID: 9049368619da4a25c66c9b95f1ea17296b441588c7bbd9637c1f18506f63dcd1
                                                                                                                                                                                                                              • Instruction ID: 78dbba2b07fa2b8dbbbe386d4d94c1a6ceea098a2a5d8f29c15745fd74c11fff
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9049368619da4a25c66c9b95f1ea17296b441588c7bbd9637c1f18506f63dcd1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B51C4B3751B6086DB118F26EC4179DB7A1FB48BB9F448226EE5A47BA4EB3CC541C301
                                                                                                                                                                                                                              Function 00007FF6113073C0 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 155COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID: _image_data$exit$rename ::source ::_source$source$tclInit$tcl_findLibrary
                                                                                                                                                                                                                              • API String ID: 1294909896-1126984729
                                                                                                                                                                                                                              • Opcode ID: d97ae4815509cc26e6e973629a1329cac86f451b544e01a121b7f206e9f1a56d
                                                                                                                                                                                                                              • Instruction ID: 834604165c50ab0cdbf02f21e7b2b36c38face2e385bfe232d5022cbfba4ade0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d97ae4815509cc26e6e973629a1329cac86f451b544e01a121b7f206e9f1a56d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F671B83AA08E46D5EB11AF25E9543A933A4FB48FA9F448131DE4E87368DF7CD549C380
                                                                                                                                                                                                                              Function 00007FFD930B2E46 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: EnvironmentVariable
                                                                                                                                                                                                                              • String ID: OPENSSL_ia32cap$~$~$~$~
                                                                                                                                                                                                                              • API String ID: 1431749950-1981414212
                                                                                                                                                                                                                              • Opcode ID: 2634814bda47d7719d861af1cfec94a442d099e0f6a35619a322e4b16ada4e8f
                                                                                                                                                                                                                              • Instruction ID: 40b87fb0fb29145773194b944262459e6d04ab5e1354371baf35e9449d186fd9
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2634814bda47d7719d861af1cfec94a442d099e0f6a35619a322e4b16ada4e8f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FD417F25F4865386FB34AF81A8601B962B8FB04B90F445239D9AD777B8DF3DE485C740
                                                                                                                                                                                                                              Function 00007FF611308260 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcscat$ByteCharMultiWide_wrmdirwcslen
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 3789554339-3944641314
                                                                                                                                                                                                                              • Opcode ID: dff885c60d23d3461016a6460ebf55cb8603be97f12bd722d7800e4d7d6e30bf
                                                                                                                                                                                                                              • Instruction ID: 73bab770df99253c07fb571ba9c9c54f1d84fd9bb2a882a5b0dce12228a7bd77
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: dff885c60d23d3461016a6460ebf55cb8603be97f12bd722d7800e4d7d6e30bf
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2721AD52B08D4244EB64A612A8146FE92A8BB86FF0FC84571ED1ED77DEEE3CE445C305
                                                                                                                                                                                                                              Function 655C97D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 84COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • recursion limit exceeded, xrefs: 655C9FAE
                                                                                                                                                                                                                              • bad marshal data (unknown type code), xrefs: 655C9F87
                                                                                                                                                                                                                              • EOF read where object expected, xrefs: 655C9897
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_String
                                                                                                                                                                                                                              • String ID: EOF read where object expected$bad marshal data (unknown type code)$recursion limit exceeded
                                                                                                                                                                                                                              • API String ID: 1450464846-1585441539
                                                                                                                                                                                                                              • Opcode ID: 72857e5f31b23ca580e303d826eac4072c2d33220b5725a31caacbc6c35201fa
                                                                                                                                                                                                                              • Instruction ID: dc9edf6bc3160556bb6a1e6f9d34eb1ca2939b0baebc8a6839550ae8d11542b0
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 72857e5f31b23ca580e303d826eac4072c2d33220b5725a31caacbc6c35201fa
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 70318E62204E84C1EB12CF59EC4879977B5FB88B9EF918615EE4907370DF3AD196C342
                                                                                                                                                                                                                              Function 00007FF6113067B0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 56stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen
                                                                                                                                                                                                                              • String ID: %U?%llu$Failed to append PYZ entry to sys.path!$Installing PYZ: Could not get sys.path!$path$strict$utf-8
                                                                                                                                                                                                                              • API String ID: 39653677-372213108
                                                                                                                                                                                                                              • Opcode ID: d4f4f0bb41883a37b964850e9d6525e6c82bda7dc6b4eb7bef36193f41cd0a21
                                                                                                                                                                                                                              • Instruction ID: e43dace06bb441e46ca1882b51d2b9a71c5baa052ed42dbfe2c5965f01b50710
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d4f4f0bb41883a37b964850e9d6525e6c82bda7dc6b4eb7bef36193f41cd0a21
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF114F66B09E1681FB10EB29E9140A87378BF88FE4B444131CE1ED77A8EE3CE505C340
                                                                                                                                                                                                                              Function 655C9CA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • bad marshal data (bytes object size out of range), xrefs: 655CAB0D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Bytes_Err_FromOccurredSizeStringmemcpy
                                                                                                                                                                                                                              • String ID: bad marshal data (bytes object size out of range)
                                                                                                                                                                                                                              • API String ID: 2675459810-66224825
                                                                                                                                                                                                                              • Opcode ID: 372bbe69b73e72245b42a05347342d6e2556be109c5071e2d3c2ef300887fc81
                                                                                                                                                                                                                              • Instruction ID: 3db665dd54a59fb4354c8f241d34f8bc98ff82026e83f2ec77fd9428e2b7775b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 372bbe69b73e72245b42a05347342d6e2556be109c5071e2d3c2ef300887fc81
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4113775349A41D6DA04DF95D8ACB5A3366FB86B89F52C85CCD0A0B714DF38E885C382
                                                                                                                                                                                                                              Function 655D0A60 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Number_$DeallocErr_InvertNegativePositiveString
                                                                                                                                                                                                                              • String ID: Invalid operator
                                                                                                                                                                                                                              • API String ID: 4031754375-2676212410
                                                                                                                                                                                                                              • Opcode ID: bb0e5358f5855027b1d18ec4438ad423c9f8c163757e117bf35e0d2341aad790
                                                                                                                                                                                                                              • Instruction ID: 56ee4e428c4930b2a7ec680c83bbaa57737bbb89105a1948faf2673ab94f0611
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bb0e5358f5855027b1d18ec4438ad423c9f8c163757e117bf35e0d2341aad790
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D0F04F2635AD02C1EB14CB3DEC5831DB362B789B56F844616E95A47778EE3D8094C34A
                                                                                                                                                                                                                              Function 65640CB0 Relevance: 9.1, APIs: 6, Instructions: 137stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: _stat64$freemallocmemcpystrlen
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4289191721-0
                                                                                                                                                                                                                              • Opcode ID: 2e8b4db83b12a41ffbe3facdde420b2ac2544ea1a3acc10374bbb150b9bb6a37
                                                                                                                                                                                                                              • Instruction ID: 56ace8c1c3186e4903d447239d00f5edcdfd6c97e3fd21de96ae64c5b98fdc6d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2e8b4db83b12a41ffbe3facdde420b2ac2544ea1a3acc10374bbb150b9bb6a37
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8151906650C6A089E724CF21E05036EBBA3F7AABA8F54C012DAE50FB48D77ED059C751
                                                                                                                                                                                                                              Function 00007FF611308590 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 75COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$_wfopenstrcpystrtok
                                                                                                                                                                                                                              • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                                              • API String ID: 1482442392-3501660386
                                                                                                                                                                                                                              • Opcode ID: 3857e9cd60ee6755af969470ea9db99d25e9f8ec4df6ec79fe72a54bffc774bc
                                                                                                                                                                                                                              • Instruction ID: 03200e64dd8320341658c664ef6508b1484b7e350b924097a3b7cb6e269cfc5c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3857e9cd60ee6755af969470ea9db99d25e9f8ec4df6ec79fe72a54bffc774bc
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A521E060E0CE4785FB20AB25AD142BA22ED5F04FF4F494572EA5DC62DEEE2CE5428200
                                                                                                                                                                                                                              Function 655D01D0 Relevance: 9.1, APIs: 6, Instructions: 72COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Dict_Item$Eval_Globals
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 298195719-0
                                                                                                                                                                                                                              • Opcode ID: d5408bdd1d46d6877632b01687fee9b399b38884ed7c7739265720aee7ef3364
                                                                                                                                                                                                                              • Instruction ID: e380ce7385be2531d364d4a4de241fe0ac32816ddd3e420fec19ae663cd23236
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: d5408bdd1d46d6877632b01687fee9b399b38884ed7c7739265720aee7ef3364
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B611C153F0B51442EE8AD79EFC683858152BB99FD4F8D8222CC0D07724FD28D9C38205
                                                                                                                                                                                                                              Function 00007FF6113083A0 Relevance: 9.1, APIs: 6, Instructions: 58COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: wcscatwcscmp
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3846154227-0
                                                                                                                                                                                                                              • Opcode ID: 540d919613c492cef5aa6eb646dd1b1cb3c8d339fc27a6144501ec21207fb444
                                                                                                                                                                                                                              • Instruction ID: 8e6fd7d5c96a9720805716239bed22239ecd372163d41879fbea657f466d91d8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 540d919613c492cef5aa6eb646dd1b1cb3c8d339fc27a6144501ec21207fb444
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2A116D14E08E428AFB64AB22A8102FE13DC5F84FE4F0840B1DD0EC66DEEE6CE5018301
                                                                                                                                                                                                                              Function 655CFB30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 164memoryCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Failed to alloc memory for spp code, xrefs: 655CFD7B
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AllocVirtualexitmemcpy
                                                                                                                                                                                                                              • String ID: Failed to alloc memory for spp code
                                                                                                                                                                                                                              • API String ID: 693558432-822294455
                                                                                                                                                                                                                              • Opcode ID: 08e832c0c9f710393ef95aa86fdc690f668fb6e3fbe4ddf920d45d3e6ddf32d7
                                                                                                                                                                                                                              • Instruction ID: d9a193d96d362e16e10bfc7cee67294009c3bee90cb96a3439ebee9496c6edcb
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 08e832c0c9f710393ef95aa86fdc690f668fb6e3fbe4ddf920d45d3e6ddf32d7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D4518AB271AB4482DF548F46E88875873A5FF09BD8F48852AEE5D477A4EF38C0A1C301
                                                                                                                                                                                                                              Function 00007FF611313048 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 154COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fwprintf$fputwc
                                                                                                                                                                                                                              • String ID: %*.*s$%-*.*s$%.*s
                                                                                                                                                                                                                              • API String ID: 2988249585-4054516066
                                                                                                                                                                                                                              • Opcode ID: 780129500cc8eb22b3af81c7775783de4b986a6307f7fb092a662ca78920ec8f
                                                                                                                                                                                                                              • Instruction ID: 5a1b3b433efee427e39deaa1f6d0b3c7f867a8ab0e4c29fdc5155cd4f06b77ef
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 780129500cc8eb22b3af81c7775783de4b986a6307f7fb092a662ca78920ec8f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E271DB76A08B49CADB50DF6AC8815A877F4F748FA8B018536EE4D87758DF38D510CB40
                                                                                                                                                                                                                              Function 655C1010 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131sleepCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Sleep_amsg_exit
                                                                                                                                                                                                                              • String ID: `fe
                                                                                                                                                                                                                              • API String ID: 1015461914-3353273076
                                                                                                                                                                                                                              • Opcode ID: 199634705dce5b4f770805382d025e87dccb6df90746fea589fb0f8542ffedc8
                                                                                                                                                                                                                              • Instruction ID: 9b9550d06393cd6cab9e1125078025130cad039e04c39752dc338ddc62f05058
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 199634705dce5b4f770805382d025e87dccb6df90746fea589fb0f8542ffedc8
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8A41C333745A4486F702CF9AEC5475523A2B784BDAF84846ADE5C47350EE3ED8E2C342
                                                                                                                                                                                                                              Function 00007FF611307D60 Relevance: 8.8, APIs: 7, Instructions: 67stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$malloc
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3157260142-0
                                                                                                                                                                                                                              • Opcode ID: bebafa3fc507f9c40b8e2e1084042dec21c5cd6be2e2a9f71abb3c5bc8a466b7
                                                                                                                                                                                                                              • Instruction ID: 9a546e083b5e079a15bde28031040c13c5b087ca8df6f7848820d4db3313fbbe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: bebafa3fc507f9c40b8e2e1084042dec21c5cd6be2e2a9f71abb3c5bc8a466b7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63113C02B4ED9644FF5BAA9359116FA55D92F46FF4E0C4430ED4ECB78AFD2CA8428350
                                                                                                                                                                                                                              Function 655D06B5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655D06A4
                                                                                                                                                                                                                              • PyErr_GivenExceptionMatches.PYTHON311 ref: 655D06E6
                                                                                                                                                                                                                              • PyTuple_Size.PYTHON311 ref: 655D0793
                                                                                                                                                                                                                              • PyErr_SetString.PYTHON311 ref: 655D0801
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • catching classes that do not inherit from BaseException is not allowed, xrefs: 655D07F5
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$DeallocExceptionGivenMatchesSizeStringTuple_
                                                                                                                                                                                                                              • String ID: catching classes that do not inherit from BaseException is not allowed
                                                                                                                                                                                                                              • API String ID: 1667255942-1287988286
                                                                                                                                                                                                                              • Opcode ID: 2ddce8402beef71e25fb151be9229e65b8e086872c143b4be1c0a7d2074ead73
                                                                                                                                                                                                                              • Instruction ID: c00a8616df912711fa4d636d0c10aabf2e5053e6905e83b6793b36860df68a2a
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2ddce8402beef71e25fb151be9229e65b8e086872c143b4be1c0a7d2074ead73
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 16218B73705B4185EB858F2AE84CB19B3A1B781F99F448226CE495B734EB3AC094C749
                                                                                                                                                                                                                              Function 655D0C40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • local variable referenced before assignment, xrefs: 655D0C8B
                                                                                                                                                                                                                              • No active exception to reraise, xrefs: 655D0C6C
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$Format$Occurred
                                                                                                                                                                                                                              • String ID: No active exception to reraise$local variable referenced before assignment
                                                                                                                                                                                                                              • API String ID: 1084603930-1116140797
                                                                                                                                                                                                                              • Opcode ID: 925c9e6883d7b0226a7ac6fd8a78dc0513a9bb80c5a8847127b5eb0d77d708e5
                                                                                                                                                                                                                              • Instruction ID: 644575126bcd704e2ac599e14d505237c336f1b838df6f2527c855f857a5de5b
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 925c9e6883d7b0226a7ac6fd8a78dc0513a9bb80c5a8847127b5eb0d77d708e5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 54F01261701E0A81EF149B65ECD836453E2BB88B96F845012DC0947334EE2EC0E5C345
                                                                                                                                                                                                                              Function 00007FFD930B1064 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 275stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memmovestrncpy
                                                                                                                                                                                                                              • String ID: ..\s\crypto\x509\x509_obj.c$0123456789ABCDEF$NO X509_NAME
                                                                                                                                                                                                                              • API String ID: 3054264757-3422593365
                                                                                                                                                                                                                              • Opcode ID: 7f77f0534d5a2a99a2cc4ad61e5207ec6cb1e36b2fae790484e7a38ba6b0187c
                                                                                                                                                                                                                              • Instruction ID: e5f3b54e68d918851ce34c79750d59a4d8a57b1e601d802f6f5610c59db8ecfe
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7f77f0534d5a2a99a2cc4ad61e5207ec6cb1e36b2fae790484e7a38ba6b0187c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D3B1F332B0868686EB30AF99E46137AB7A8FB447C8F144175DA8E67785DE7CF401C700
                                                                                                                                                                                                                              Function 00007FFD930B158C Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 131COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memchr
                                                                                                                                                                                                                              • String ID: ..\s\crypto\x509v3\v3_utl.c$E$FALSE$TRUE
                                                                                                                                                                                                                              • API String ID: 3297308162-1433594941
                                                                                                                                                                                                                              • Opcode ID: afb071bca9fb63d4d8150a353952ceb48a3f39d8d44ea172c003c9b4e1cef4c6
                                                                                                                                                                                                                              • Instruction ID: 3cffe568c6d30fa43c5945f40a445ccbd2a7bf4e7232f84176f6084ec1e3c897
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: afb071bca9fb63d4d8150a353952ceb48a3f39d8d44ea172c003c9b4e1cef4c6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1A51B325B09B4284FA34EFE6A4703BA62A8AF44B80F844439ED4D77795DF7CE641D304
                                                                                                                                                                                                                              Function 655D2730 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 109stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: sprintfstrlen
                                                                                                                                                                                                                              • String ID: ../src/platforms/windows/hdinfo.c$/%d:$No any serial number of harddisk got
                                                                                                                                                                                                                              • API String ID: 1090396089-4267867539
                                                                                                                                                                                                                              • Opcode ID: ac58de0b02559ea35e239e7b5920a514f9373c233a009cfc2dd28759ab763dff
                                                                                                                                                                                                                              • Instruction ID: 05b2d9363daf1451f6ffe4ac11d2150450b3a457ba3477c55a75cf7920dc6697
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac58de0b02559ea35e239e7b5920a514f9373c233a009cfc2dd28759ab763dff
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 68319953B0945049EB60CE3DAC287ACA213B796BF9F988331CD294B784DA3985C7C348
                                                                                                                                                                                                                              Function 655D16C0 Relevance: 7.6, APIs: 5, Instructions: 100COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • PyFunction_NewWithQualName.PYTHON311 ref: 655D170C
                                                                                                                                                                                                                              • _Py_Dealloc.PYTHON311 ref: 655D1797
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DeallocFunction_NameQualWith
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2691592392-0
                                                                                                                                                                                                                              • Opcode ID: 3077c3de32299fc1994f2696746d037fd12b2bf16bfa47a1dd58350e40abc364
                                                                                                                                                                                                                              • Instruction ID: 4d29aacf2fdd0f96df02e4ace6db0588d37e01026e5b04dfbb3c682784ce57cf
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3077c3de32299fc1994f2696746d037fd12b2bf16bfa47a1dd58350e40abc364
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6531A43334AE40C2EA89CF5EE94C729B2A5F745BD5F484620DE2607B20EF34C491C349
                                                                                                                                                                                                                              Function 655E0FE0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 97COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: N != NULL$src/math/rand_prime.c
                                                                                                                                                                                                                              • API String ID: 0-3192267683
                                                                                                                                                                                                                              • Opcode ID: cb910b647e8abcccaead9b9b7fe59af7af402870bf1f0b7ef6196090397879d1
                                                                                                                                                                                                                              • Instruction ID: bcdb52681da7f3265faeec0c182f53b85d06aad601d75021b3ff6bd3ac142ed5
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: cb910b647e8abcccaead9b9b7fe59af7af402870bf1f0b7ef6196090397879d1
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: FB31272230868586E725DF16EC08B6EAB65B786BE8F844125ED1A8BB94EF3DC541C700
                                                                                                                                                                                                                              Function 655C9D93 Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 655C8C70: memcpy.MSVCRT ref: 655C8CC9
                                                                                                                                                                                                                                • Part of subcall function 655C8C70: PyOS_string_to_double.PYTHON311 ref: 655C8CDB
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C9DB7
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655CA08D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_Occurred$S_string_to_doublememcpy
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 282781714-0
                                                                                                                                                                                                                              • Opcode ID: 3d968de7e1fe6efd12466ac0b279690b6bd23adde742df7babe8a3660f4b82b3
                                                                                                                                                                                                                              • Instruction ID: d66d783ec293f9530ebe548648b0e3628acfd2f5e7bcd7944ec1c21c776a9858
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3d968de7e1fe6efd12466ac0b279690b6bd23adde742df7babe8a3660f4b82b3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63115165649A40CAD606DFA0C46CB1A33B6BB85799F52EA8DD90627210DF35E881D383
                                                                                                                                                                                                                              Function 655C9E50 Relevance: 7.6, APIs: 5, Instructions: 55COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 655C8810: PyFloat_Unpack8.PYTHON311 ref: 655C8841
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C9E74
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655CA02D
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_Occurred$Float_Unpack8
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3006406168-0
                                                                                                                                                                                                                              • Opcode ID: 369cc6e6fab0356e349259fa79c6b7736e3a29e6c76bd7c5fb254614319366de
                                                                                                                                                                                                                              • Instruction ID: a9dd119f302648dababd8dd36dac1e4c3a6b0e14a7099fc5a2f93f662d279b10
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 369cc6e6fab0356e349259fa79c6b7736e3a29e6c76bd7c5fb254614319366de
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3E119061648A40C6D601DFA1D8ACB4A33B6FB86789F42DE8DDD0627210DF35F482E3C2
                                                                                                                                                                                                                              Function 00007FF611302AD0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DialogLongWindow$InvalidateRect
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1200242243-0
                                                                                                                                                                                                                              • Opcode ID: 57b41cf59eeebec43940bf3f5d915734346139c7fb041d6f7fac98ec8a71f233
                                                                                                                                                                                                                              • Instruction ID: 921dcbd2f04ac0dfe9e23e53c63de1a17d3a306dce3db26bb15bc6a74e4f117c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 57b41cf59eeebec43940bf3f5d915734346139c7fb041d6f7fac98ec8a71f233
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D018C31E1CD7642FB683B6A68852B921C9AF88FB1F554830D90AC5BDDDC6C68C29300
                                                                                                                                                                                                                              Function 6561D6A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 233fileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: abortfwrite
                                                                                                                                                                                                                              • String ID: '$illegal index register
                                                                                                                                                                                                                              • API String ID: 1067672060-451399654
                                                                                                                                                                                                                              • Opcode ID: 8fda720d08536c9c7f86e7d72d6a805ff540ad46f21f2d47b2444522e335936a
                                                                                                                                                                                                                              • Instruction ID: 96d33956d7a75d81f3e0330d08506ce4844ae2e5eb055506ae35163bcf9b8dd4
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8fda720d08536c9c7f86e7d72d6a805ff540ad46f21f2d47b2444522e335936a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7918BB761AB99C4DB228F3DE890A4C3B75E395F88B9AC112CB4D47B14CA7EC456C710
                                                                                                                                                                                                                              Function 00007FF61130E640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: CCG
                                                                                                                                                                                                                              • API String ID: 0-1584390748
                                                                                                                                                                                                                              • Opcode ID: 0e3aed78a1e4c150b1ff523e32ba85c0a188e2a4dfc2739e81b31b52371fb521
                                                                                                                                                                                                                              • Instruction ID: 0e4ecac4ac4ad5357a4eb92c74e36a837a43b8f1b0fbf910ca19f15380ff0b0e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0e3aed78a1e4c150b1ff523e32ba85c0a188e2a4dfc2739e81b31b52371fb521
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C9410F72F09E268AF7249B64D5443BC27E8AB45F78F104A35CA2DD77E8CE3CA6418251
                                                                                                                                                                                                                              Function 00007FFD930B3841 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: ..\s\crypto\bio\b_sock.c$J$host=
                                                                                                                                                                                                                              • API String ID: 0-1729655730
                                                                                                                                                                                                                              • Opcode ID: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
                                                                                                                                                                                                                              • Instruction ID: f2cb1f9e87c7c7199f0f694002f1a0f7249b9a8e6a6be15e99720249e51c8a8f
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 31c7aae0c6204fcaae541c015ea13e20bcfa82d779c5bb0f8b846d03ff15bf19
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5131A132B0868282EB20DF95F4611AEA374FB85784F840035EB8D63BAADF7DD5449B00
                                                                                                                                                                                                                              Function 655CFDA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81memoryfileCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • Failed to alloc memory for bcc code, xrefs: 655CFE97
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: AllocVirtualfwritememcpy
                                                                                                                                                                                                                              • String ID: Failed to alloc memory for bcc code
                                                                                                                                                                                                                              • API String ID: 1603020442-783995166
                                                                                                                                                                                                                              • Opcode ID: b428dafa0490d868059339f54b4b7a73ddaf40ac8375481d99a28d422e384d13
                                                                                                                                                                                                                              • Instruction ID: c92dfdfd98e9b95e720341ebd4ad38059adb16915cf40e7d8ba5290994afd775
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: b428dafa0490d868059339f54b4b7a73ddaf40ac8375481d99a28d422e384d13
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8321DEB2702B5486DB548F5AE88076877A4FB0DFD9F48912AEF0D83354EB38C1A2C340
                                                                                                                                                                                                                              Function 655C99A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • bad marshal data (string size out of range), xrefs: 655CA0DF
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$OccurredString
                                                                                                                                                                                                                              • String ID: bad marshal data (string size out of range)
                                                                                                                                                                                                                              • API String ID: 114435612-3115314950
                                                                                                                                                                                                                              • Opcode ID: 8b1a550116f0c324f3e4c57fad5cc2c73eefae9cb2877b347941cd34b56c2525
                                                                                                                                                                                                                              • Instruction ID: 065ccceb7fcf20a91aa8924412b76c89ffcd62536ab4a385a5ab61a62671b7f1
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8b1a550116f0c324f3e4c57fad5cc2c73eefae9cb2877b347941cd34b56c2525
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0E11C672305A8486EB12CF45EC487A673B1BF88B99F45856CCE4D17714EF38E489D342
                                                                                                                                                                                                                              Function 00007FF611302DC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              • MessageBoxW.USER32 ref: 00007FF611302E28
                                                                                                                                                                                                                              • MessageBoxA.USER32 ref: 00007FF611302E4B
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Failed to get UTF-8 buffer size.$WideCharToMultiByte
                                                                                                                                                                                                                              • API String ID: 1878133881-785100509
                                                                                                                                                                                                                              • Opcode ID: 996ea42dbfbdc6150fb3e78afd1d99beba1d91d16d45c08ba1a9db144a0f4385
                                                                                                                                                                                                                              • Instruction ID: 331f44d4d53625b863712c2d933f9928b3f5198ed5dcff3cfd9be422d15525bd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 996ea42dbfbdc6150fb3e78afd1d99beba1d91d16d45c08ba1a9db144a0f4385
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2001D16371569005FB256622BD0ABFA05896B49FE1F888034EF4D97BC9EC3CD582C704
                                                                                                                                                                                                                              Function 655C2ECE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_Formatexit
                                                                                                                                                                                                                              • String ID: %s (%d:%d)$\(
                                                                                                                                                                                                                              • API String ID: 2212715685-1109738240
                                                                                                                                                                                                                              • Opcode ID: e747bb5f631494d9453c9f18b9f4efe0d826f169312f5ee0d90a09e36386c2e3
                                                                                                                                                                                                                              • Instruction ID: 71f36ed67453079e8ba9a861225dd639282c8d532cb97743f27bc9e2529d01f2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: e747bb5f631494d9453c9f18b9f4efe0d826f169312f5ee0d90a09e36386c2e3
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D8110262355B8884EB41CF95EC943AA3760F785B95F856466DD5F0B394CF3CC142C742
                                                                                                                                                                                                                              Function 655C9F30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_$String$Occurred
                                                                                                                                                                                                                              • String ID: bad marshal data (invalid reference)
                                                                                                                                                                                                                              • API String ID: 1118661901-2759865940
                                                                                                                                                                                                                              • Opcode ID: f3fe2ad5349754e4a9757f78037221e52d129df4df06ccd699d249bb2566b44c
                                                                                                                                                                                                                              • Instruction ID: 3e29b29041c3dab9ea8585a8c71ee1a5f635ff6f5c271b37e2f2e2c8875a323e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f3fe2ad5349754e4a9757f78037221e52d129df4df06ccd699d249bb2566b44c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 411117B5304E40C6EB05CF55DC98B0933B6FB84BA5F92A949DA1947224DF35D4D9C382
                                                                                                                                                                                                                              Function 00007FF6113045A0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharFileModuleMultiNameWide
                                                                                                                                                                                                                              • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                              • API String ID: 1532159127-1977442011
                                                                                                                                                                                                                              • Opcode ID: a705923171a296baecb93f2081270a394e4d88c8d8c6dfbd024d0ef3db960c6d
                                                                                                                                                                                                                              • Instruction ID: ad38949581b534d2057e1c825f5c2f854a9ac41c18d49ac2ecdfa60e9268b5ab
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a705923171a296baecb93f2081270a394e4d88c8d8c6dfbd024d0ef3db960c6d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: E1F04952B1CD1381FB68A725AC193B902EDAF08FE0F444435E80EC6ADEED1DEA468300
                                                                                                                                                                                                                              Function 655D1C90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20windowCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • ../src/platforms/windows/hdinfo.c, xrefs: 655D1CD0
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorFormatFreeLastLocalMessage
                                                                                                                                                                                                                              • String ID: ../src/platforms/windows/hdinfo.c
                                                                                                                                                                                                                              • API String ID: 1365068426-2451707101
                                                                                                                                                                                                                              • Opcode ID: c9c70334066065b88396303e7bd641ee83867a9d70dae79d63c15fefd2233f3d
                                                                                                                                                                                                                              • Instruction ID: ad4e4ada93c1b1fb4ed91767e7d73b94eb71408d56c75f64ce9afdc74f9973b7
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c9c70334066065b88396303e7bd641ee83867a9d70dae79d63c15fefd2233f3d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: F2F03931304F80C2E7109B65E81574A7B72F3C9B86F904025EA8A03B64CF3EC15ACB42
                                                                                                                                                                                                                              Function 00007FFD932D9650 Relevance: 6.5, APIs: 5, Instructions: 232COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memcmp
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1475443563-0
                                                                                                                                                                                                                              • Opcode ID: f9a5f847c0a831fcffc5b112e7359bb239a83faf7b63a308c16b99dc0b69426a
                                                                                                                                                                                                                              • Instruction ID: 4f4dd87b234e10297550c9eb9f63e816ddf29bf30b8c91edb2a741ef838232dd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f9a5f847c0a831fcffc5b112e7359bb239a83faf7b63a308c16b99dc0b69426a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78919261B0D65785FB309BA6D9606FD13AAFF41788F449131EE1D6BA89EE38E405C300
                                                                                                                                                                                                                              Function 00007FF611308480 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: strlen$strcpystrtok
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 3698421117-0
                                                                                                                                                                                                                              • Opcode ID: c07b8759f16da2138d4d66d79236ce0cafdfe8c8ac8761bac40afba6f90c1058
                                                                                                                                                                                                                              • Instruction ID: 3c0976ed524fc1e886d7767cd73579945dea498afd8a60da550a383558e21deb
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: c07b8759f16da2138d4d66d79236ce0cafdfe8c8ac8761bac40afba6f90c1058
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3C219011B49E4285FB22A651A8053FA52995F45FF0F880531ED0DC77CEEE3CE556C344
                                                                                                                                                                                                                              Function 655E1C50 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • src/pk/asn1/der/sequence/der_decode_sequence_multi.c, xrefs: 655E1DA2
                                                                                                                                                                                                                              • in != NULL, xrefs: 655E1DA9
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: in != NULL$src/pk/asn1/der/sequence/der_decode_sequence_multi.c
                                                                                                                                                                                                                              • API String ID: 0-85593093
                                                                                                                                                                                                                              • Opcode ID: a3131317ed16eb42bf37b0103d1b8f19e9f7bff5b66bc058039bdfa7e818c662
                                                                                                                                                                                                                              • Instruction ID: ddf4a2eb1fb07a6202932a1fe36df6e615bc2d5fcd85dc317141c884643019ac
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a3131317ed16eb42bf37b0103d1b8f19e9f7bff5b66bc058039bdfa7e818c662
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 21310732705A808AEB14CF19E918F9D7266F785BD8F848028EE4D87B44DB39C551CB40
                                                                                                                                                                                                                              Function 00007FF6113051B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 81COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              • calloc.MSVCRT ref: 00007FF6113051D1
                                                                                                                                                                                                                                • Part of subcall function 00007FF611309090: MultiByteToWideChar.KERNEL32(00007FF611302E07,WideCharToMultiByte,?,Failed to get UTF-8 buffer size.,?,?,00007FF611302FD0), ref: 00007FF6113090C6
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ByteCharMultiWidecalloc
                                                                                                                                                                                                                              • String ID: _MEIPASS2
                                                                                                                                                                                                                              • API String ID: 2568606709-3944641314
                                                                                                                                                                                                                              • Opcode ID: 153298e754a5da29828527c7272e57dc28a8d1b5d2e4a766274f553e5afb193d
                                                                                                                                                                                                                              • Instruction ID: c2d88bec3e508551eee575b6aba525e77e25bd04edd0237e6571beeaa7f890a8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 153298e754a5da29828527c7272e57dc28a8d1b5d2e4a766274f553e5afb193d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BD219861B09E0986FB149B699D802B973A9BF45BB1F544335DE2DC23D8EE28E0108600
                                                                                                                                                                                                                              Function 00007FF611302CC0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free$ByteCharMultiWide
                                                                                                                                                                                                                              • String ID: Failed to obtain/convert traceback!
                                                                                                                                                                                                                              • API String ID: 3219091393-982972847
                                                                                                                                                                                                                              • Opcode ID: 9418ccf11d311c357f2c0b44d681edf2e8f7f8742d0759f808d0dfda2e738276
                                                                                                                                                                                                                              • Instruction ID: 36f04ec6f88cd3a2bc258049d2dc4832329a60f1c62f89f35d7fe934959795e2
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9418ccf11d311c357f2c0b44d681edf2e8f7f8742d0759f808d0dfda2e738276
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E014F01B5A96905FE5965B629266BA51990F09FE0E489434ED0ECBB8AED1CE4024300
                                                                                                                                                                                                                              Function 655C9D40 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 655C8810: PyFloat_Unpack8.PYTHON311 ref: 655C8841
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C9D60
                                                                                                                                                                                                                              • PyFloat_FromDouble.PYTHON311 ref: 655CA054
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Float_$DoubleErr_FromOccurredUnpack8
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4123378784-0
                                                                                                                                                                                                                              • Opcode ID: df84d80ce26176bde0440ccc8e8eb441c179f26da343db27623bb656fa75ebc2
                                                                                                                                                                                                                              • Instruction ID: 5e567385b00126dabfe243aef5d54219e0316156d1a71f47d7b341d0bcf48653
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: df84d80ce26176bde0440ccc8e8eb441c179f26da343db27623bb656fa75ebc2
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24017C75249600C6D605DFA1C86CB1A77B6FB857C9F02D98CDD0617610DB34F481D382
                                                                                                                                                                                                                              Function 655C9EF4 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                                • Part of subcall function 655C8C70: memcpy.MSVCRT ref: 655C8CC9
                                                                                                                                                                                                                                • Part of subcall function 655C8C70: PyOS_string_to_double.PYTHON311 ref: 655C8CDB
                                                                                                                                                                                                                              • PyErr_Occurred.PYTHON311 ref: 655C9F14
                                                                                                                                                                                                                              • PyFloat_FromDouble.PYTHON311 ref: 655CA0B4
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: DoubleErr_Float_FromOccurredS_string_to_doublememcpy
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1362591179-0
                                                                                                                                                                                                                              • Opcode ID: 5910be8271225f76af7be4214b668b5b79cf73ca39909755ef6c69e926973e7f
                                                                                                                                                                                                                              • Instruction ID: 5293bb7adbc0ec95bafa6a4bb487f4d314149cf87c4171f0260f6776bb889f3e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5910be8271225f76af7be4214b668b5b79cf73ca39909755ef6c69e926973e7f
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 180178A5249A00C6E604DFA1D86CB1A37BAFB457C9F02DA8CDE061B610DB38F481D383
                                                                                                                                                                                                                              Function 655C9C43 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_FromLongLong_Occurred
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4098471257-0
                                                                                                                                                                                                                              • Opcode ID: 4e7236585997c914534fc8fba7d195fb651d18099bb673999376ffb29699eab5
                                                                                                                                                                                                                              • Instruction ID: 4ffd0236aa66019d49fea4d5dc658a777e4cf316309cd4f487c8d2e163fcdf29
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4e7236585997c914534fc8fba7d195fb651d18099bb673999376ffb29699eab5
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D901F665349610C2EA04DFA1C8ACB1A37B6EB85B95F529C9CCE160B204DE38E885D382
                                                                                                                                                                                                                              Function 00007FFD930B6A1E Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 330COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID: ..\s\crypto\user\eng_ctrl.c$b
                                                                                                                                                                                                                              • API String ID: 0-1836817417
                                                                                                                                                                                                                              • Opcode ID: 6a8c4ebf4a0a0db44f30e3cc5f857322594d81500bd7b086c438121fe743cf03
                                                                                                                                                                                                                              • Instruction ID: abd7502ea6d436145ce39a7b61df28976a63ffd6d4bcf493644dd9f69bc6080d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a8c4ebf4a0a0db44f30e3cc5f857322594d81500bd7b086c438121fe743cf03
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C1E1AE22B1C28686FB749BD2E52077A23A9FF80744F548139DA9E27A95CF3DF945C700
                                                                                                                                                                                                                              Function 00007FFD930B3387 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorLastgetsockname
                                                                                                                                                                                                                              • String ID: ..\s\crypto\bio\b_sock.c
                                                                                                                                                                                                                              • API String ID: 566540725-540685895
                                                                                                                                                                                                                              • Opcode ID: a7a9d23270d94e37348a85efb9068d8d5f36d2912cc69f144dbe1a5ed76ec5ab
                                                                                                                                                                                                                              • Instruction ID: b3851f0e521bd1df5e98d5a56f1378c9bbdd849d95eeda4dd38e47c318bc02f6
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: a7a9d23270d94e37348a85efb9068d8d5f36d2912cc69f144dbe1a5ed76ec5ab
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: BB21B072B5850686EB20DFA1D8246EE7365FF90304F840135E6AC13AA1DF7DE6D9EB40
                                                                                                                                                                                                                              Function 655C80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Err_Format
                                                                                                                                                                                                                              • String ID: %s (%d:%d)
                                                                                                                                                                                                                              • API String ID: 376477240-1595188566
                                                                                                                                                                                                                              • Opcode ID: 0a7436336b2bb26b475b0088d45aa805510d6ee1d1385048329f8fc96a24bc68
                                                                                                                                                                                                                              • Instruction ID: faa075164ffe086e7fae1211f46b20b4feb5b27cc11e75e8bb842daa24447183
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a7436336b2bb26b475b0088d45aa805510d6ee1d1385048329f8fc96a24bc68
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2901F537A04A5485EB019B59DC943993391FB85B45FDA8069CD5E17361CB2AC982C383
                                                                                                                                                                                                                              Function 00007FF61130DBC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-3474627141
                                                                                                                                                                                                                              • Opcode ID: 20dae29a08e59d28e827f7f7a2a2eda8259e4d1817ef6dbd98be60ed78e0c5d9
                                                                                                                                                                                                                              • Instruction ID: 83cd38c150c21dcc6a206d56e2a343aac2aaa16d0ed3991e54ce75f160be39ec
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 20dae29a08e59d28e827f7f7a2a2eda8259e4d1817ef6dbd98be60ed78e0c5d9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 83216F26A04FC48AD7118F68D8413EA7375FF59BA8F444622EE8C57768EF38D249C300
                                                                                                                                                                                                                              Function 00007FFD930B251D Relevance: 5.3, APIs: 4, Instructions: 301COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                                              • Opcode ID: 8c6eff884418fc92cc5e26df02b3eed974339047e7975db595e20ff13a8e19e6
                                                                                                                                                                                                                              • Instruction ID: 05666c8d67b777f214b1d5951a864520fe82644d38681b82939a8e389995bdca
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8c6eff884418fc92cc5e26df02b3eed974339047e7975db595e20ff13a8e19e6
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8AC1A576B0868086DB30CF9AB4547AAB7A5FB88BC4F444136EE8D67B59DF3CD1058B40
                                                                                                                                                                                                                              Function 00007FF611302FE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: Message_errno
                                                                                                                                                                                                                              • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                              • API String ID: 1796756983-2410924014
                                                                                                                                                                                                                              • Opcode ID: 89ab3f84670d69496295afaeef3f91396c60eac41d8d5ed9af97d336e694a63d
                                                                                                                                                                                                                              • Instruction ID: c28294c9a89b346d21826169c9b2e5bff147003e177ddd24247e852ee4af21bc
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 89ab3f84670d69496295afaeef3f91396c60eac41d8d5ed9af97d336e694a63d
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7D01FF6261CA8191E324AB51F4007EA62A8FB98BE0F504135EB8D53B9D9E3CD656CB40
                                                                                                                                                                                                                              Function 00007FF61130DC40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4273532761
                                                                                                                                                                                                                              • Opcode ID: baefd7cba75bd780381bd2d5fed287ff04b74d7fa079984f5394eb8e5ce75d69
                                                                                                                                                                                                                              • Instruction ID: 614a5cfc97548770ad11d54b2da1bc4c32960a977976bb582593597519d62a9e
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: baefd7cba75bd780381bd2d5fed287ff04b74d7fa079984f5394eb8e5ce75d69
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 14015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC4D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2187435201
                                                                                                                                                                                                                              • Opcode ID: 81b53d873045e560598026d8c864cfe1e58fa63b90fba301861682825eddf50a
                                                                                                                                                                                                                              • Instruction ID: 991929bb0221d0ccdbae86cc5719e2498dfa6eac88ff986c4a2e6d33164df791
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 81b53d873045e560598026d8c864cfe1e58fa63b90fba301861682825eddf50a
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 92015A26A04F888AD7118F69D8402AA7779FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2713391170
                                                                                                                                                                                                                              • Opcode ID: 06bf403f4c0a9af45a90ca5965f87b6ee5c3a6750db8dc5ebbd969be290419dd
                                                                                                                                                                                                                              • Instruction ID: 1a0d58422669a28d37bbbca04a876133b6798bdb7d21cda2d00c0aea62eeea42
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 06bf403f4c0a9af45a90ca5965f87b6ee5c3a6750db8dc5ebbd969be290419dd
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A7015E26904F888AD7118F69D8402AA7775FF4DBA8F044722EE8D27768DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-2468659920
                                                                                                                                                                                                                              • Opcode ID: ec9f448085d72bf13c83586b7c52257c26f7af234c67fb9552149ff3dd26a3a7
                                                                                                                                                                                                                              • Instruction ID: ab7acd62de75aa1df805807dd5b92a3e5c17fc3ed1e501a2969a32f59a844363
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec9f448085d72bf13c83586b7c52257c26f7af234c67fb9552149ff3dd26a3a7
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8F015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D67728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC26 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4064033741
                                                                                                                                                                                                                              • Opcode ID: fc72b1ca348bb75ea9640cba4845ceefab8200df23c4986763f386d421d396ac
                                                                                                                                                                                                                              • Instruction ID: cd6684805ad6265800390dd79e64661528e02356433dd864c571321267a38df1
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc72b1ca348bb75ea9640cba4845ceefab8200df23c4986763f386d421d396ac
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63015E26904F888AD7118F69D8402AA7775FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 00007FF61130DC33 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: fprintf
                                                                                                                                                                                                                              • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                                                                                                                                                                              • API String ID: 383729395-4283191376
                                                                                                                                                                                                                              • Opcode ID: 1dadd9d91598fd59cd3ee44cef548247d0e8863d0b21ccbc5bbcccc010ffab5c
                                                                                                                                                                                                                              • Instruction ID: d2e26451fd359e7ea30e872cf20c2c22af6540c0d195cb8b107f978fdfae3719
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1dadd9d91598fd59cd3ee44cef548247d0e8863d0b21ccbc5bbcccc010ffab5c
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0D015A26A04F888AD7118F69D8402AA7779FB4DBA8F044722EE8D27728DF28C145C300
                                                                                                                                                                                                                              Function 655DD200 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              • LTC_ARGCHK '%s' failure on line %d of file %s, xrefs: 655DD216
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: __iob_funcabort
                                                                                                                                                                                                                              • String ID: LTC_ARGCHK '%s' failure on line %d of file %s
                                                                                                                                                                                                                              • API String ID: 1307436159-2823265812
                                                                                                                                                                                                                              • Opcode ID: 99d6edcdf46810ba0b76ea370e310c263b2d6a49728293579bc19f9b3fbd7be9
                                                                                                                                                                                                                              • Instruction ID: d8aa3875196ea46e5536ea2c20576d4c152b27e6b2155433e4c0bcdb51c0eefd
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99d6edcdf46810ba0b76ea370e310c263b2d6a49728293579bc19f9b3fbd7be9
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: A1D0A770320E6551DB105F16ED44B9D9B65FB6DFE8F84C121ED4DA7B155B14C216C340
                                                                                                                                                                                                                              Function 00007FFD930B6BE5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21networkCOMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Strings
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: ErrorLastioctlsocket
                                                                                                                                                                                                                              • String ID: ..\s\crypto\bio\b_sock.c
                                                                                                                                                                                                                              • API String ID: 1021210092-540685895
                                                                                                                                                                                                                              • Opcode ID: 4b3498a1bc9275628b4fed3f0116b26741c55f820a8da06fdf06bba4b20f0e59
                                                                                                                                                                                                                              • Instruction ID: f181d1aa3c402313d9159dcf342ea9b9d3d879356c41469e70d1b2029f04cbd8
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4b3498a1bc9275628b4fed3f0116b26741c55f820a8da06fdf06bba4b20f0e59
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 89E09251B5950386F7316BE19824BB62218AF14304F400538E91DA27A1DF3DA2459A00
                                                                                                                                                                                                                              Function 00007FFD930B53E4 Relevance: 5.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2268221059.00007FFD930B1000.00000020.00000001.01000000.00000014.sdmp, Offset: 00007FFD930B0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268198166.00007FFD930B0000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD930BD000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93115000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93129000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD93139000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD9314D000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268221059.00007FFD932FC000.00000020.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD932FE000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93329000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD9335A000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD93380000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268543744.00007FFD933A6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268693373.00007FFD933CE000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268714611.00007FFD933D4000.00000004.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933D6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F2000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268733206.00007FFD933F6000.00000002.00000001.01000000.00000014.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ffd930b0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: memmove
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 2162964266-0
                                                                                                                                                                                                                              • Opcode ID: f8fc3825456b718fa61beb737ea69a31c942ec99b197afecc34420bc9983a393
                                                                                                                                                                                                                              • Instruction ID: 9aee8370f5793d6e2c91000dff7d6912d521d9d9de5eda3f7e99132405de3b50
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8fc3825456b718fa61beb737ea69a31c942ec99b197afecc34420bc9983a393
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: C111D032B04A8182DB70EB5AE1501A96364EB44BD0F448132EF5DA7B96EF28E5D1C300
                                                                                                                                                                                                                              Function 65640510 Relevance: 5.0, APIs: 4, Instructions: 42COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2263976468.00000000655C1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 655C0000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2263954108.00000000655C0000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264025215.0000000065642000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264042915.0000000065646000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264060848.0000000065647000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264089420.000000006565F000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264107813.0000000065662000.00000004.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264126823.0000000065664000.00000008.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2264145538.0000000065668000.00000002.00000001.01000000.0000000F.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_655c0000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: CriticalSection$EnterLeavefree
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 4020351045-0
                                                                                                                                                                                                                              • Opcode ID: ec840dfc4ae41f17e291a0d69645ba4a6c5c997fc4c67aef1303447780a82588
                                                                                                                                                                                                                              • Instruction ID: f332e7965b8410ecb7b3583439a2ad29ed66d8c6ce61743f54508716d0bc107d
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: ec840dfc4ae41f17e291a0d69645ba4a6c5c997fc4c67aef1303447780a82588
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63017C61326B50C6EB4CCB59EE9036523A2F7A8B65FD0E425DD198B320FB39C4A1C311
                                                                                                                                                                                                                              Function 00007FF611304960 Relevance: 5.0, APIs: 4, Instructions: 41COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1294909896-0
                                                                                                                                                                                                                              • Opcode ID: 9c4186f722e86582c3b1398c543642522ac53436e10a90fe38125ad0e5a34d3b
                                                                                                                                                                                                                              • Instruction ID: 135b8bc12ab8c9e5dc827b3fb08364c05a0372c10145f2bdbcdaa445df2b548c
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9c4186f722e86582c3b1398c543642522ac53436e10a90fe38125ad0e5a34d3b
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: D6017127E4991982EB509B6AB4412BD32B9FF88F64F155231DE0DC734ADD28D882C780
                                                                                                                                                                                                                              Function 00007FF611307060 Relevance: 5.0, APIs: 4, Instructions: 26COMMON
                                                                                                                                                                                                                              Download Yara Rule
                                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                                              • Source File: 00000003.00000002.2267917600.00007FF611301000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF611300000, based on PE: true
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267898435.00007FF611300000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2267973392.00007FF61131A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268008338.00007FF61131B000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268070057.00007FF611325000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611327000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268093201.00007FF611329000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268142435.00007FF61132A000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              • Associated: 00000003.00000002.2268164253.00007FF61132D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_7ff611300000_winws1.jbxd
                                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                                              • API ID: free
                                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                                              • API String ID: 1294909896-0
                                                                                                                                                                                                                              • Opcode ID: 17bb4e15e412b02df2bc7990f2a8c6dca0a60341a4ea025c79cb532fcc6a30aa
                                                                                                                                                                                                                              • Instruction ID: 840a8d54c22161b11d819af650f246fbc9d32983dc32b8c8661f910423b2f066
                                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17bb4e15e412b02df2bc7990f2a8c6dca0a60341a4ea025c79cb532fcc6a30aa
                                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0FF0EC19F4BD0A41FF1AE6A1B4103FD62685F44F60F044130CF8DDB6499E2CA4438300